package json lock major version