use exact versions in package.json

closes #130