unpinned dependency version requirements