lock all dependency versions