update and pin some packages