component.json: Pin deps