fix: freeze python-box version

Merge request reports