Update app-shell and upload and pull in transitive deps for now

We didn't allow rollup to look into vendored node_modules so we avoid
multiple version in the same bundle, but this breaks in case a vendored
packages has a new dep not used elsewhere.

For now just add the dep in the app.