deps: use semver in a less ad hoc way
1.0.3