GPM plugin that locks top level dependencies versions