package json lock dependency version