point to a pinned version of cenkalti/backoff