sha reference changed in dependency