fix: pin version in packageManager