deps: npm update semver

This updates the version of semver shipped with npm in the 0.8 branch to allow it to be able to install packages that have `^` specifiers in the dependencies.

TODO -- warn on publishing