Cherry pick locked down package.json