bump dependcy versions, document todos