Update dependency bounds and use vado from hackage