locked version of ejwt dep