why do npm packages still insist on installing their own versions of popular dependencies? it's not like we're trying to have a good time installing our own versions of lodash...