lock dependencies to specific versions