lock versions down correctly