update dependencies
closes #7: do not rewrite paths relative to base
bump version