web/package.json: no lock file: direct dependencies recorded with their declared versions only, transitive dependencies are missing
