Lock runtime dependency versions to minor releases