must still hardcode dependency versions