Using upper bounds for dependency versions