use exact versions in package.json