pin requirements
fix urls