Sometimes I wonder if requiring <2.3.0 might be more appropriate, so that we know that it will only match dependency API versions we have QE'd Pulp against. That way, if 2.3.0 is incompatible with Pulp, we won't install that version. If it's not imcompatible, I suppose we should QE that version and change the requirement.

Of course, YMMV, IANAL, etc.