migrate package-lock.json to version 2