locked dependencies