package.json: fixed dependencies