Make auto upgrade careful about breaking changes (fixes #1047)