fix package version since only the root package can whitelist package stabilities