annoyingly, turns out that due to the leading zero, `"^0.12"` behaves
just like `"^0.12.0"` (according to https://semver.npmjs.com) - once we
hit v1.0, that will be different (e.g. `"^1.0"` would include v1.9.2)