Specify dependencies more precisely to avoid issues

[danielpeintner]

see #378 (review)

[egekorkan]

I like the comment #378 (review)

Another possibility would be to also push the lock files so that the environment that tests it has the exact version we need. It also enables dependabot or similar things to work

[relu91]

Another possibility would be to also push the lock files so that the environment that tests it has the exact version we need. It also enables dependabot or similar things to work.

Right, I've just seen that the package-lock is ignored. Usually, it should be committed (see here). With this fix we don't need to specify the exact version.