locked dependencies, closes #28