locking package deps