pin ranged dependencies to an installed version