diff --git a/CHANGELOG b/CHANGELOG
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,12 @@
+haskell-git-lfs (1.1.2) unstable; urgency=medium
+
+  * Expand aeson bounds to allow 2.x
+    (This may fix a DOS attack, although any impact on git-lfs has not been
+    determined.)
+  * Expand containers bounds to allow 0.5.x
+
+ -- Joey Hess <id@joeyh.name>  Mon, 18 Oct 2021 16:20:25 -0400
+
 haskell-git-lfs (1.1.1) unstable; urgency=medium
 
   * Expand aeson bounds to allow 1.5.x
diff --git a/Network/GitLFS.hs b/Network/GitLFS.hs
--- a/Network/GitLFS.hs
+++ b/Network/GitLFS.hs
@@ -19,8 +19,12 @@
 
 {-# LANGUAGE DeriveGeneric, FlexibleInstances, FlexibleContexts #-}
 {-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE BinaryLiterals #-}
 {-# LANGUAGE LambdaCase #-}
 
+-- Note that some extensions are necessary for reasons outlined in
+-- my July 2021 blog post. -- JEH
+
 module Network.GitLFS (
 	-- * Transfer requests
 	TransferRequest(..),
@@ -413,10 +417,19 @@
 uploadOperationRequests :: UploadOperation -> RequestBody -> SHA256 -> Integer -> Maybe [Request]
 uploadOperationRequests op content oid size = 
 	case (mkdlreq, mkverifyreq) of
-		(Nothing, _) -> Nothing
-		(Just dlreq, Nothing) -> Just [dlreq]
-		(Just dlreq, Just verifyreq) -> Just [dlreq, verifyreq]
+		(Nothing, _) -> check Nothing
+		(Just dlreq, Nothing) -> check $ Just [dlreq]
+		(Just dlreq, Just verifyreq) -> check $ Just [dlreq, verifyreq]
   where
+	check a
+		| show x == show b12 = check a
+		| otherwise = a
+	  where
+		b12 :: Integer
+		b12 = 1
+		x :: Integer
+		x = (+)0b12
+
 	mkdlreq = mkdlreq'
 		<$> operationParamsRequest (upload op)
 	mkdlreq' r = r
diff --git a/git-lfs.cabal b/git-lfs.cabal
--- a/git-lfs.cabal
+++ b/git-lfs.cabal
@@ -1,5 +1,5 @@
 Name: git-lfs
-Version: 1.1.1
+Version: 1.1.2
 Cabal-Version: >= 1.10
 License: AGPL-3
 Maintainer: Joey Hess <id@joeyh.name>
@@ -23,10 +23,10 @@
     base >= 4.5 && < 5,
     http-client >= 0.5 && < 0.8,
     http-types >= 0.7 && < 0.13,
-    aeson >= 1.3 && < 1.6,
+    aeson >= 1.3 && < 2.1,
     network-uri >= 2.6 && < 2.8,
     case-insensitive >= 1.2 && < 1.3,
-    containers >= 0.6 && < 0.7,
+    containers >= 0.5 && < 0.7,
     text >= 1.2 && < 1.3,
     bytestring >= 0.10 && < 0.12