make dependency versions strict