pin dev deps to semver compatible versions