package lock json latest version