package-lock.json deleted because of  Dependabot alert