specify pessimistic version constraints for dev dependencies