lock down dep versions