lock package versions