add paypal-ipn advisory
update deps