tidy package.json and loosen dependencies