pin deps

I also removed one dep which wasn't being used