locking dependecy versions