Updated to CHANGELOG and locking for dependencies