missed this from the first name change
adding mix.lock back in at the advice of @ericmj
relaxing the exact contraints of deps