add comment next to ambiguous dependency version strings

Add a TODO comment next to ambiguous dependency version strings, so humans can manually go in and update those versions.

Otherwise, identical version strings will never be updated.