Update dependencies versions. cc@pdehann

Not sure if you want to drop the `~` from async. It seems to be the only `dependency` that has a semver range operator.