fix sources
pin versions
new dependencies