package json version locking