Locking down dependency versions