Locking down new dependencies