lock dependency version.