lockdown versions in metadata