bump third-party submodule hash