pin deps to versions