lock gemspec deps