when tracking a dependency as a submodule, don't track it via package.json too