Locking in dependency versions