Use exact versions in package.json

Because I don't trust peoples use of semver.