package: use wide semver ranges for deps we control

we can reevaluate post v1. getting annoyed with updating deps all the
time.
0.12.2