Lock down dependency versions