cabal: upper bounds on all dependencies