Lock down dependencies correctly