lock down 0.0.x versions

as `~` causes unexpected and non-semver behaviour on them.

https://github.com/isaacs/node-semver