pin to specific versions in requirements.txt