You also have a bunch of mix-version packages:
"strapi": "3.4.6",
"strapi-admin": "3.4.6",
"strapi-connector-bookshelf": "^3.4.6",
"strapi-middleware-cache": "^1.5.0",
"strapi-plugin-content-manager": "3.4.6",
"strapi-plugin-content-type-builder": "3.4.6",
"strapi-plugin-documentation": "^3.5.2",
"strapi-plugin-email": "3.4.6",
"strapi-plugin-graphql": "^3.5.2",
"strapi-plugin-upload": "3.4.6",
"strapi-plugin-users-permissions": "3.4.6",
"strapi-provider-upload-cloudinary": "3.4.6",
"strapi-utils": "3.4.6",
All Strapi maintained packages (IE not the strapi-middleware-cache as it’s not ours) should be the same version without the carot ^