revert to explicit package versions

Signed-off-by: Joshua Rubin <jrubin@zvelo.com>