package.json: update dependency, bump version