Lock dependency versions down