lock down dependency versions
bump version