freeze dependency versions