deps: pin dependencies