This also closes #165

Maintainers, is it possible to instead use caret ranges, e.g. ^3.1.2 instead of pinning dependencies?

That way, if there is a security vulnerability in this package (or in serve), you guys don't need to manually update this package.

As far as I understand, Vercel folks prefer pinning dependencies in their products. Here is Next.js, for example:
package.json#L76-L83 (caniuse-lite is an exception because it tracks recent browser releases).

This way they save their users from accidental upstream breaking changes within a semver range. Not sure this approach can be revisited easily, so I doubt we’ll be able to introduce ^ or ~ in this PR 😅

I need to merge this PR.

@vercel, can you give this PR some attention? 🥺