correct semver usage

Current `package.json` tells NPM that it's ok to install all minor and patch upgrades for the dependencies - e.g. ~1.5 tests true for 1.x.x - but minor upgrades can introduce breaking changes.

This PR restricts upgrades on the patch level only.