package: update dependencies, use "^"