updated package.json (no wildcard deps)