use package versions for cache invalidation