pinning deps in package.json