lock dependencies