Lock package's dependencies