bump dependency and plugin versions
clean key later to avoid corruption of URIs containing dashes fixes #21