Lock dependencies to minor-version, track patch version