[fix] npm dependency lockdown