When upgrading packages, don't pin anything.

Fixes #2526.