Pin deps

This is mostly related to the fact that unpinned dependencies end up using a version of `popover` that in the end fetch a version of `closest` that is currently deprecated and ends up breaking builds.