move post-update.js deps into a proper package.json file