bump upper bounds: HaXml < 1.26, pandoc-citeproc < 0.7, lens < 4.7