nailing versions of dependencies *finally*