deps: pin for safety and consistency