lock in npm dependency versions