add safe-url to dependencies