cabal: add upper bounds to dependencies