lock down package versions and update templates with javascript block