Lock versions in package.json