Upper bound for package:js

Robust against future breaking changes.