deps: soft pin testing dependencies