npm update nested dependencies