fixed client-side so semver doesn't explode when nbbpm returns 'latest', fixed tests so they pass again, #2363