pin some dependency versions