locked dependency versions