The version constraint on json seems very strict, so let's relax it a
little bit, so that the version can be bumped independently in the
main lockfile.