Allow patch-level range for auth0-js dep

[lexaurin]

Please allow patch-level range for auth0-js dep in package.js

Imagine you're using both auth0-js and auth0-lock in your project. npm installs packages as you expect:

awesome-project
├── auth0-js@8.6.0 
└── auth0-lock@10.16.0

but when you update auth0-js to the latest patch version it got duped:

awesome-project
├── auth0-js@8.6.1 
└─┬ auth0-lock@10.16.0 
  └─┬ auth0-js@8.6.0 
    └── qs@6.4.0 

it's quite annoying and does not respect npm versioning best practices, but who cares right? Unless you really need the latest patched version and not two versions, one of them not patched.

PR will follow

[luisrudge]

but there's no actual duplication, right? I mean.. npm3+ dedupes automatically, no?

[lexaurin]

There is. NPM3 dedups only what is semver-valid for all dependencies. auth0-js@8.6.1 is not valid for 8.6.0 rule in auth0-lock so no dedup happen.

[luisrudge]

Makes sense! Thanks for the PR 🎉

[lexaurin]

Thanks for merging 👍