we read 3rd party from package.json, and check source deps (expressed as relative paths in package.json and targets in BUILD files) match up