Lock deps in gemspec