lock down dev deps