Lock versions in setup.py