bump versions of upstream dependencies