Bump semver to version 3

This makes the '^' operator stricter for 0.x.y versions, even if 'x' is
not 0.

As a direct result, several *other* deps had to be updated, because they
either depended on semver 2.x, or because the new stricter rules meant
that they (or their deps) were no longer valid.

The update to 'read-installed', in particular, causes a test failure.
That update must be rolled back, or the test made to pass, prior to a
stable npm 2.0.0 release going out.

doc/misc/semver.md

@@ -66,11 +66,11 @@ The following range styles are supported:
   prerelease) will be supported up to, but not including, the next
   major version (or its prereleases). `1.5.1` will satisfy `^1.2.3`,
   while `1.2.2` and `2.0.0-beta` will not.
-* `^0.1.3` := `>=0.1.3-0 <0.2.0-0` "Compatible with `0.1.3`". `0.x.x` versions are
-  special: the first non-zero component indicates potentially breaking changes,
-  meaning the caret operator matches any version with the same first non-zero
-  component starting at the specified version.
-* `^0.0.2` := `=0.0.2` "Only the version `0.0.2` is considered compatible"
+* `^0.1.3` := `0.1.3` "Compatible with `0.1.3`". `0.x.x` versions are
+  special: since the semver spec specifies that `0.x.x` versions make
+  no stability guarantees, only the version specified is considered
+  valid.
+* `^0.0.2` := `0.0.2` "Only the version `0.0.2` is considered compatible"
 * `~1.2` := `>=1.2.0-0 <1.3.0-0` "Any version starting with `1.2`"
 * `^1.2` := `>=1.2.0-0 <2.0.0-0` "Any version compatible with `1.2`"
 * `1.2.x` := `>=1.2.0-0 <1.3.0-0` "Any version starting with `1.2`"