actual bounds from android autobuilder
use pinned package versions from cabal.config