freeze versions of third-party libraries, to avoid surprises