Bump dependency upper version bounds