I was dumb. Permitting 0.12.4 removes the ability to use hex.pm, which breaks dependency integrations.

oops!