Lock down dependencies