Bump third party dependencies

Oops. Good catch. No, spread doesn't work that way. Will fix.