lock down dependencies