Be more sane about dependency bounds