pnpm update package lock