Apply best practices: pin versions