restrict tox dependencies