Use pessimistic version constraint for all runtime dependencies

See: http://yehudakatz.com/2010/08/21/using-considered-harmful-or-whats-wrong-with/