locking versions of dependencies down