We use a number of non-public APIs in the test package, which makes our
dependency quite fragile. This patch pins a specific, known-good version. We
should update to the lastest version in a follow-up patch.