npm override nested dependency version