package json version lock