Open dependency range intervals are not respected

[renatoathaydes]

Run:

▶ jbuild deps -t com.yubico:webauthn-server-core:2.6.0
Dependencies of com.yubico:webauthn-server-core:2.6.0 (incl. transitive):
  - scope runtime
    * com.fasterxml.jackson.core:jackson-databind:[2.13.2.1,3) -> 2.18.3 [runtime]
        * com.fasterxml.jackson.core:jackson-annotations:2.18.3 [compile]
        * com.fasterxml.jackson.core:jackson-core:2.18.3 [compile]
    * com.google.guava:guava:[24.1.1,33) -> 33.0.0-jre [runtime]
        * com.google.code.findbugs:jsr305:3.0.2 [compile]
        * com.google.errorprone:error_prone_annotations:2.23.0 [compile]
        * com.google.guava:failureaccess:1.0.2 [compile]
        * com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava [compile]
        * com.google.j2objc:j2objc-annotations:2.8 [compile]
        * org.checkerframework:checker-qual:3.41.0 [compile]
    * com.upokecenter:cbor:[4.5.1,5) -> 5.0.0-alpha2 [runtime]
        * com.github.peteroupc:datautilities:1.1.0 [compile]
        * com.github.peteroupc:numbers:1.8.2 [compile]
    * com.yubico:yubico-util:2.6.0 [runtime]
        * com.fasterxml.jackson.core:jackson-databind:[2.13.2.1,3) [compile] (-)
        * com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:[2.13.2.1,3) -> 2.18.3 [runtime]
            * com.fasterxml.jackson.core:jackson-core:2.18.3 [compile] (-)
            * com.fasterxml.jackson.core:jackson-databind:2.18.3 [compile]
                * com.fasterxml.jackson.core:jackson-annotations:2.18.3 [compile] (-)
                * com.fasterxml.jackson.core:jackson-core:2.18.3 [compile] (-)
        * com.fasterxml.jackson.datatype:jackson-datatype-jdk8:[2.13.2.1,3) -> 2.18.3 [runtime]
            * com.fasterxml.jackson.core:jackson-core:2.18.3 [compile] (-)
            * com.fasterxml.jackson.core:jackson-databind:2.18.3 [compile] (-)
        * com.fasterxml.jackson.datatype:jackson-datatype-jsr310:[2.13.2.1,3) -> 2.18.3 [runtime]
            * com.fasterxml.jackson.core:jackson-annotations:2.18.3 [compile] (-)
            * com.fasterxml.jackson.core:jackson-core:2.18.3 [compile] (-)
            * com.fasterxml.jackson.core:jackson-databind:2.18.3 [compile] (-)
        * com.upokecenter:cbor:[4.5.1,5) [runtime] (-)
        * org.slf4j:slf4j-api:[1.7.25,3) -> 2.1.0-alpha1 [runtime]
    * org.apache.httpcomponents.client5:httpclient5:[5.0.0,6) -> 5.5-alpha1 [runtime]
        * org.apache.httpcomponents.core5:httpcore5-h2:5.3.3 [compile]
            * org.apache.httpcomponents.core5:httpcore5:5.3.3 [compile]
        * org.apache.httpcomponents.core5:httpcore5:5.3.3 [compile] (-)
        * org.slf4j:slf4j-api:1.7.36 [compile]
    * org.slf4j:slf4j-api:[1.7.25,3) [runtime] (-)

Notice this line:

com.upokecenter:cbor:[4.5.1,5) -> 5.0.0-alpha2

The interval [4.5.1,5) says that 5 is the exclusive upper bound, but JBuild resolves the version to 5.0.0-alpha2 which is not allowed by the interval.