pin dependencies, to test automatic publishing