pin deps versions