Fix package-lock for security warnings