freeze versions in requirements file