pnpm update package lock json