Freeze the versions of package.json dependencies using package-lock.json, for example "rxjs": "~6.6.0" will become "rxjs": "6.6.3".
Everything is done in the browser, no HTTP requests are sent. Your secrets are safe.
To use it: https://xavierdupessey.github.io/freeze-packagejson-deps/