lockdown pre 1.0 deps to the exact version

allow post 1.0 deps to be locked down to compatible versions ^