use fixed dependency versions