add tested back to bundledDependencies, as we don’t have a underscore dev del

move minimatch up to a dev dependency to not confuse NPM