lock down dependency gem versions