Use the exact versions dependencies

And remove unused `which` package.

This issue come up before, but we didn't actually do anything about it.