Pin dependencies maintained by matrix.org to [semantic version](https://semver.org/) bounds.