add upper bound to xml pubspec dependency