lock down dep version