A dependency with an external source may not specify version requirements