locked in dependency version