add explicit dependency and repo references to make sonar happy