fix validator dependence update that break constraints also force version in package.json