Make servicepack-update dependency-safe: never downgrade downstream deps