put a version constraint on deps