update 3rd party shas