lock down dependencies just a bit for safety