fix dependency version to use upper bound