update deps in package.json