diff --git a/.snyk b/.snyk
index 99b7055..1beadec 100644
--- a/.snyk
+++ b/.snyk
@@ -1,5 +1,5 @@
 # Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
-version: v1.7.0
+version: v1.13.3
 ignore: {}
 # patches apply the minimum changes required to fix a vulnerability
 patch:
@@ -14,3 +14,108 @@ patch:
   'npm:tough-cookie:20160722':
     - tilelive-vector > request > tough-cookie:
         patched: '2017-02-18T10:10:55.162Z'
+  'npm:hoek:20180212':
+    - mbtiles > sqlite3 > node-pre-gyp > request > hawk > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-vector > mapnik > node-pre-gyp > hawk > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-bridge > mapnik > node-pre-gyp > hawk > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mbtiles > sqlite3 > node-pre-gyp > hawk > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilejson > requestretry > request > hawk > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mapnik > node-pre-gyp > request > hawk > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-vector > request > hawk > sntp > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mapnik > node-pre-gyp > hawk > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-vector > request > hawk > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mapnik > node-pre-gyp > hawk > sntp > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-bridge > mapnik > node-pre-gyp > request > hawk > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mapnik > node-pre-gyp > request > hawk > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mbtiles > sqlite3 > node-pre-gyp > request > hawk > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-tmsource > tilelive-bridge > mapnik > node-pre-gyp > hawk > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilejson > requestretry > request > hawk > sntp > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mapnik > node-pre-gyp > request > hawk > sntp > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mapnik > node-pre-gyp > hawk > cryptiles > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mbtiles > sqlite3 > node-pre-gyp > hawk > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-bridge > mapnik > node-pre-gyp > hawk > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-vector > mapnik > node-pre-gyp > hawk > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-vector > mapnik > node-pre-gyp > hawk > sntp > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-vector > mapnik > node-pre-gyp > request > hawk > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilejson > requestretry > request > hawk > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-bridge > mapnik > node-pre-gyp > hawk > sntp > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mbtiles > sqlite3 > node-pre-gyp > hawk > sntp > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-vector > request > hawk > cryptiles > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-vector > request > hawk > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-vector > mapnik > node-pre-gyp > request > hawk > sntp > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-bridge > mapnik > node-pre-gyp > request > hawk > sntp > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mbtiles > sqlite3 > node-pre-gyp > request > hawk > sntp > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mbtiles > sqlite3 > node-pre-gyp > hawk > cryptiles > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-tmsource > tilelive-bridge > mapnik > node-pre-gyp > hawk > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-tmsource > tilelive-bridge > mapnik > node-pre-gyp > hawk > sntp > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-bridge > mapnik > node-pre-gyp > hawk > cryptiles > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-vector > mapnik > node-pre-gyp > request > hawk > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-bridge > mapnik > node-pre-gyp > request > hawk > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-vector > mapnik > node-pre-gyp > hawk > cryptiles > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilejson > requestretry > request > hawk > cryptiles > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-tmsource > tilelive-bridge > mapnik > node-pre-gyp > request > hawk > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mapnik > node-pre-gyp > request > hawk > cryptiles > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-tmsource > tilelive-bridge > mapnik > node-pre-gyp > hawk > cryptiles > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-tmsource > tilelive-bridge > mapnik > node-pre-gyp > request > hawk > sntp > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-tmsource > tilelive-bridge > mapnik > node-pre-gyp > request > hawk > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mbtiles > sqlite3 > node-pre-gyp > request > hawk > cryptiles > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-vector > mapnik > node-pre-gyp > request > hawk > cryptiles > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-bridge > mapnik > node-pre-gyp > request > hawk > cryptiles > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilelive-tmsource > tilelive-bridge > mapnik > node-pre-gyp > request > hawk > cryptiles > boom > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+    - mapnik > node-pre-gyp > hawk > hoek:
+        patched: '2019-04-20T03:20:25.075Z'
+  'npm:tough-cookie:20170905':
+    - tilelive-vector > request > tough-cookie:
+        patched: '2019-04-20T03:20:25.075Z'
+  'npm:tunnel-agent:20170305':
+    - tilelive-vector > request > tunnel-agent:
+        patched: '2019-04-20T03:20:25.075Z'
+    - tilejson > requestretry > request > tunnel-agent:
+        patched: '2019-04-20T03:20:25.075Z'
diff --git a/package.json b/package.json
index 4e2e593..359bc37 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "async": "^1.5.2",
     "carto": "^0.15.3",
     "express": "^4.13.3",
-    "mapnik": "^3.5.2",
+    "mapnik": "^4.0.0",
     "mbtiles": "^0.8.2",
     "md5": "^2.0.0",
     "mkdirp": "^0.5.1",
@@ -37,10 +37,10 @@
     "tilelive-http": "^0.10.0",
     "tilelive-mapnik": "^0.6.17",
     "tilelive-tmsource": "^0.4.3",
-    "tilelive-tmstyle": "^0.5.1",
+    "tilelive-tmstyle": "^0.7.0",
     "tilelive-utfgrid": "^0.2.0",
     "tilelive-vector": "^3.8.0",
-    "snyk": "^1.25.0"
+    "snyk": "^1.151.2"
   },
   "snyk": true
 }