Locking versions in package.json is simplier and is as safe

And allows for caching modules in our npm cache/proxy
as it does not interfere with protocols and such
`mobile.git` why this is not `mercury.git` ? :radio: