Allow tags or urls as dependencies

The requirement that they be semver ranges is too strict.