bumps dependency versions