start to lock the version of the dependencies instead of allowing for dynamic updates