pin deps using semver1

somebody is going to complain that they can't install stuff because
they haven't upgraded npm