fixed updating of dependencies referenced by specific commit hash
added tests for not updating packages referenced by specific commit hash