attempt to lock down tighter dependencies