factor out common dependency versions