BUG: specify package versions more strictly