[metadata] dependency cookbook version constraints/pins