bump validator, loosen dev deps