Bump random upper version bounds

Allow `parallel-io` to use the latest version of `random` (1.1).