Lock dependencies only to major versions and let minor versions auto-upgrade for security fixes

[soygul]

Classical security vs stability tradeoff. Being a web service API, security wins so it's time to let the patch versions float.