Dependency fixes

Bumped lens to 4.2
Add specific aeson bound, to get around failing lens builds (see ekmett/lens#450)