manually lock down a few bones deps - works around #2401