lock dependency versions + bump version