pin depedencies