package: pin dev deps