don't lock the dependencies