lock in the version numbers and dependencies