bump manifests/tunnel deps, + less strict versions