Lock in package versions