`xo` was the only package not to be fixed to an exact version. Fix (hoho) this.