manually dedupe by hoisting to parent package.json