Explicitly pin guava and cassandra-thrift to ensure clients use correct version