lock external dependencies to a version number
0.1.4