Locking versions in package.json is simplier and is as safe

And allows for caching modules in our npm cache/proxy
as it does not interfere with protocols and such