gemspec: lock reqs