use more specific dependency versions