well maybe not... package.json locks your deps down