deps: pin testing dependencies