use https URLs for deps