bump kumquat version, includes fix for catch-all domains