We shouldn't exact-pin the dependencies versions

[julienw]

This was changed in #601.

Hey @rimiti, any reason why you removed the ^ ? Without that symbol, this means you pin to that exact version. I don't mind much for devDependencies which are local to this project, but for dependencies this effectively locks them also for any project that depends on supertest.

The main issue is if one of these transitive dependencies has a security alert and fixes it with a minor version => we (downstream projects) won't be able to update it unless supertest does it too.

What do you think?

I'd be happy doing the change in a PR if you'd like.