manually fetch deps (and pin their versions)