no longer use "latest" in dependencies , not safe