update versions of upstream modules listed in package.json