Bump dependencies upper bounds

This built just fine on my computer, but I wouldn't know if `snap-cors` continues to behave as expected.