update dependency bounds