update submodule refs for form-locking