pin dependencies - less likely to break in the future