firewall: bump to git HEAD