Make Poison dependency less strict

[alex88]

I think that since you use just decode and encode the poison dependency could be made less strict and support also 2.0 and 3.0