If the versions of direct dependencies in package.json are fixed exactly, why is package-lock.json still needed?