Pin versions in package.json, safety first kids