Hard-code commits of deps in requirements.txt