upgrade quiescent vendors

I also added `[com.facebook/react "0.9.0.2"]`, as required by quiescent 0.1.2.