fixating versions of dependencies