ah, the difference is that this way is not git-tracked. It's updated by `npm upgrade` (if we take care to bump the version on the other side) If we DON'T bump the version, then we need to manually delete it from node_modules and `npm install` again