pin lxml version