lock version of dependencies