version bound on bytes dependency