set upper bounds on dependencies for testing