bump upper bound to allow base-4.7
depend on data-default-class alone, since we don't use instances