pin the dependencies down