update package.json (dependencies)