locking in dependencies