Bump third party dependencies

But the first control path returns a string. Does spread work with non-array values?