locked dep versions