pin all packages to specific versions