deps: lock in dependency versions

Ran into edge cases that is forcing us to do this.