Pin dependencies

We don't set any minimum requirement which can lead to subtle and difficult to debug issues.