package-lock.json deleted because of Dependabot alert