package json dependencies without version