explicit versioning of dependencies