dependency lockdown