use https on dependency