freeze package versions