fix: Always reference dependencies at a specific commit tree, not master.