use https links in dependencies