lock external dependencies to a version number
0.2.5