lock deps down