2.4.2 package-lock.json