package lock json peer dependencies