using explicit versions in package.json