lock dependency versions