pin dependencies