lock down some dependencies and fix specs