lock minor dependencies