use pessimistic versioning for dependencies