package json overrides dependencies