update npm and lockfile