Define version requirements for dependencies

Unless I'm oblivious to the reason this is not currently being done?

---

RFC @abrandoned @localshred