dont lock dependencies