Pin down all package versions