fix for newer OpenAL, lock down deps