Pointing deps to repo SHAs