diff --git a/CHANGELOG.md b/CHANGELOG.md
index 543d3d947..812a96309 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,11 @@ Changelog
 
 # 2.x release
 
+## v2.6.2
+
+- Fix: used full filename for main in package.json
+- Other: pinned codecov & teeny-request (had one breaking change with spread operators)
+
 ## v2.6.1
 
 **This is an important security release. It is strongly recommended to update as soon as possible.**
diff --git a/package.json b/package.json
index 216046916..4bb7d9640 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
     "name": "node-fetch",
-    "version": "2.6.1",
+    "version": "2.6.2",
     "description": "A light-weight module that brings window.fetch to node.js",
-    "main": "lib/index",
+    "main": "lib/index.js",
     "browser": "./browser.js",
     "module": "lib/index.mjs",
     "files": [
@@ -48,7 +48,7 @@
         "chai-as-promised": "^7.1.1",
         "chai-iterator": "^1.1.1",
         "chai-string": "~1.3.0",
-        "codecov": "^3.3.0",
+        "codecov": "3.3.0",
         "cross-env": "^5.2.0",
         "form-data": "^2.3.3",
         "is-builtin-module": "^1.0.0",
@@ -60,7 +60,7 @@
         "rollup": "^0.63.4",
         "rollup-plugin-babel": "^3.0.7",
         "string-to-arraybuffer": "^1.0.2",
+        "teeny-request": "3.7.0",
         "whatwg-url": "^5.0.0"
-    },
-    "dependencies": {}
+    }
 }
diff --git a/rollup.config.js b/rollup.config.js
index a201ee455..1bc88f8db 100644
--- a/rollup.config.js
+++ b/rollup.config.js
@@ -18,10 +18,6 @@ export default {
     tweakDefault()
   ],
   external: function (id) {
-    if (isBuiltin(id)) {
-      return true;
-    }
-    id = id.split('/').slice(0, id[0] === '@' ? 2 : 1).join('/');
-    return !!require('./package.json').dependencies[id];
+    return isBuiltin(id);
   }
 };