package-lock.json: update