manual dependency update with pinned foreman