Allow patch updates only on package.json

[luixxiul]

Test plan

#11458

---

Description

Allow patch updates only on package.json.

#11453 (comment)

This change looks working: https://travis-ci.org/brave/browser-laptop/jobs/286654321#L3827, https://travis-ci.org/brave/browser-laptop/jobs/286672237#L3490

It seems to me that that we would have to consider to start replacing carets with tildes on package.json for now to accept patch updates only. Minor updates could break builds easily and it will take quite long time (took me a day) to find which package causes that breakage. IMO we should eventually remove semver dependency and update package.json manually (until we get ready for using Greenkeeper #1701 for example ).

Steps to Reproduce

1. rm -rf node_modules && npm i
2. Search package.json for carets ^
3. Replace ^ with tildes ~
4. npm list
5. Replace the version numbers with ones on the list.

Actual result:

Minor updates sometimes causes a nasty bug.

Expected result:

Semver should be removed eventually. We could start by narrowing the version number range.

Reproduces how often: [What percentage of the time does it reproduce?]

Brave Version

about:brave info:

Reproducible on current live release:

Additional Information

[bsclifton]

I don't think this is needed at this time, since manual updates are required to change package versions