Lock down dependencies to specific versions