dependency bump

see commits