pin-down dependency versions