package lock json node version