Upgrading dependencies security issue