locked dependencies [skip ci]