use https urls for deps