Shouldn't you also restrict version number for a package not just the latest?