update dependency to address security vulnerability