package: pin versions