set exact versions in package.json