version lock all npm deps