policing the dependency packages versions