update dependency links to point to tarball