package: use better semver syntax for pinning