add dependency specs

adds semver. `*` might be different. basically de facto specs
otherwise. closes #1