pin deps and float devDeps with `~`