pubspec : dev_dependencies don't need an upper bound

those are not consumed by users of the package