github dependabot package lock json