bump upstream dependencies