lock down to 1.2.0 using the SHA