bump dependencies (CVE-2014-7818, CVE-2014-7819)