set version constraints for dependencies