add package_ensure param as dirty workaround to pass explicit package versions