pinned dependencies