add upper bounds to dependencies