Nailed package.json down to specific versions