use concrete versions for dependencies