Locks in dependency versions