pin deps version