Correct dependencies: do not pin to the most fresh ones, but to actually stated by upstream