lock down dev dep versions