lockin module version; use module-deps from package.json