unversioned dependencies are a no-no