bump upper bounds to allow base-4.7 and unix-2.7