freeze npm versions