Sigh. Pip changed the semantics of -U in pip 10. go back to the old way so we're actually testing changing deps; if it breaks we need to know.