Fix dependency bounds
Fix dependency bounds

It turns out there exists a package versioning policy for Haskell. It is
similar to semantic versioning, but the major version consists of two
parts, for example:

    3.0.2.2
    --- - -
     ^  ^ ^--- patch
     |  |
     |  +----- minor
     |
     +-------- major

So I should tighten some of the upper bounds. I *should* also specify
minor versions on the lower bounds, but with Stack I don't think this is
actually a problem. In fact, there is little need for version bounds
at all with Stack: you just get the versions that are in the specified
Stackage, and if it works, great, if it doesn't work, then something
needs updating.

ruuda/hoff,ruuda/hoff