package json dependency version syntax