bump dependencies in package.json