tighten dependencies, temporarily allow phpcr-utils dev