do not pin hard versions