Lock versions in requirements.txt