lock all dependencies