pinning proper dep versions