move js-yaml and lodash to dependencies