Pin dependencies

to satisfy crates.io policy.