version lock libraries in buildout