add version pins for new dependencies