use exact version in package.json