lock octokit dependency to patch level