all dependencies must have a 'version_requirement'