use publicly accessible deps in package.json