Updates to CHANGELOG and locking for dependencies