pin release to 2.8.4, otherwise checksums can fail