Lock all versions in a local package.json file