force package versions to be certain