locking dependencies to gems in prep for release