add CORS and update deps