Lock dependency versions