lock package.json updates
1.0.1