test: nan-ify tests
package: loosely pin the deps