Bump dependency upper bounds