Lock versions down

Seems like bad practice to not express gem version dependencies
when we're clearly sensitive to changes on them.