_oasis: add version constraint to rss dependency