lock in npm dependencies