require exact versions of dependencies