safer way to get package versions