use exact versions for dependencies