update and lock dev dependencies