package.json pinned devDeps versions