locking versions for dependencies, bumping version number