Locking down packages to the latest version