Allow URLs as dependencies

The requirement that they be semver ranges is too strict.