Why are we pinpointing to commit hashes on instaclick dependencies?