move deps into package.json