lockdown pre 1.0 deps to the exact version
allow post 1.0 deps to be locked down to compatible versions ^