Dependency prefixes are a supply chain risk: let's fix them

Dependency prefixes like ^ and ~ make updates easy, but the version ranges they create widen the path a compromised package can take into production.