pin our pip modules to specific versions