package lock json dev true removed