Stronger dependency version locking