bump dependency versions