lock down module versions