Locks versions in package.json