Pin dependency versions

Thanks to @easternbloc for spotting this.