explicitly state versions of dependencies