Lock down Assemble + dependency versions