update package-lock