Give bounds for the dependencies; fixes #3141