relax versions in package.json