locking deps to 2.x