strict module deps to published in npm versions