don't include boms in managed deps