lock github dependencies to sha
fix editor refresh call