remove peerDep; version lock roots

allows this to work with npm v2