update dependencies

Review by @joneshf or @garyb