diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,12 @@
 See also http://pvp.haskell.org/faq
 
+0.6.1.0
+-------
+
+* Support basic auth in package-indices (#252)
+* Fix tests due to new aeson handling of unescaped control sequences (#256)
+* Bump a lot of bounds on packages we depend on
+
 0.6.0.1
 -------
 
diff --git a/hackage-security.cabal b/hackage-security.cabal
--- a/hackage-security.cabal
+++ b/hackage-security.cabal
@@ -1,6 +1,6 @@
 cabal-version:       1.12
 name:                hackage-security
-version:             0.6.0.1
+version:             0.6.1.0
 
 synopsis:            Hackage security library
 description:         The hackage security library provides both server and
@@ -24,7 +24,7 @@
 license-file:        LICENSE
 author:              Edsko de Vries
 maintainer:          cabal-devel@haskell.org
-copyright:           Copyright 2015-2016 Well-Typed LLP
+copyright:           Copyright 2015-2022 Well-Typed LLP
 category:            Distribution
 homepage:            https://github.com/haskell/hackage-security
 bug-reports:         https://github.com/haskell/hackage-security/issues
@@ -110,13 +110,13 @@
                        Hackage.Security.Util.TypedEmbedded
                        Prelude
   -- We support ghc 7.4 (bundled with Cabal 1.14) and up
-  build-depends:       base              >= 4.5     && < 4.15,
-                       base16-bytestring >= 0.1.1   && < 0.2,
-                       base64-bytestring >= 1.0     && < 1.1,
-                       bytestring        >= 0.9     && < 0.11,
+  build-depends:       base              >= 4.5     && < 4.17,
+                       base16-bytestring >= 0.1.1   && < 1.1,
+                       base64-bytestring >= 1.0     && < 1.3,
+                       bytestring        >= 0.9     && < 0.12,
                        Cabal             >= 1.14    && < 1.26
                                       || >= 2.0     && < 2.6
-                                      || >= 3.0     && < 3.4,
+                                      || >= 3.0     && < 3.8,
                        containers        >= 0.4     && < 0.7,
                        ed25519           >= 0.0     && < 0.1,
                        filepath          >= 1.2     && < 1.5,
@@ -126,8 +126,8 @@
                        -- 0.4.2 introduces TarIndex, 0.4.4 introduces more
                        -- functionality, 0.5.0 changes type of serialise
                        tar               >= 0.5     && < 0.6,
-                       template-haskell  >= 2.7     && < 2.17,
-                       time              >= 1.2     && < 1.10,
+                       template-haskell  >= 2.7     && < 2.19,
+                       time              >= 1.2     && < 1.13,
                        transformers      >= 0.3     && < 0.6,
                        zlib              >= 0.5     && < 0.7,
                        -- whatever versions are bundled with ghc:
@@ -254,15 +254,16 @@
                        bytestring,
                        network-uri,
                        tar,
+                       text,
                        time,
                        zlib
 
   -- dependencies exclusive to test-suite
-  build-depends:       tasty            == 1.2.*,
+  build-depends:       tasty            >= 1.2 && < 1.5,
                        tasty-hunit      == 0.10.*,
                        tasty-quickcheck == 0.10.*,
-                       QuickCheck       >= 2.11 && <2.14,
-                       aeson            == 1.4.*,
+                       QuickCheck       >= 2.11 && <2.15,
+                       aeson            == 1.4.* || == 1.5.* || == 2.0.*,
                        vector           == 0.12.*,
                        unordered-containers >=0.2.8.0 && <0.3,
                        temporary        >= 1.2 && < 1.4
diff --git a/tests/TestSuite/JSON.hs b/tests/TestSuite/JSON.hs
--- a/tests/TestSuite/JSON.hs
+++ b/tests/TestSuite/JSON.hs
@@ -1,3 +1,4 @@
+{-# LANGUAGE CPP #-}
 {-# OPTIONS_GHC -fno-warn-orphans #-}
 module TestSuite.JSON (
     prop_roundtrip_canonical,
@@ -21,23 +22,30 @@
 import Data.Aeson (Value (..), eitherDecode)
 import Data.String (fromString)
 import qualified Data.Vector as V
+#if MIN_VERSION_aeson(2,0,0)
+import qualified Data.Aeson.KeyMap as KM
+#else
 import qualified Data.HashMap.Strict as HM
+#endif
 
+-- text
+import qualified Data.Text as Text
+
 prop_aeson_canonical, prop_roundtrip_canonical, prop_roundtrip_pretty, prop_canonical_pretty
-  :: JSValue -> Bool
+  :: JSValue -> Property
 
 prop_roundtrip_canonical jsval =
-    parseCanonicalJSON (renderCanonicalJSON jsval) == Right (canonicalise jsval)
+    parseCanonicalJSON (renderCanonicalJSON jsval) === Right (canonicalise jsval)
 
 prop_roundtrip_pretty jsval =
-    parseCanonicalJSON (BS.pack (prettyCanonicalJSON jsval)) == Right jsval
+    parseCanonicalJSON (BS.pack (prettyCanonicalJSON jsval)) === Right jsval
 
 prop_canonical_pretty jsval =
-    parseCanonicalJSON (renderCanonicalJSON jsval) ==
+    parseCanonicalJSON (renderCanonicalJSON jsval) ===
     fmap canonicalise (parseCanonicalJSON (BS.pack (prettyCanonicalJSON jsval)))
 
 prop_aeson_canonical jsval =
-    eitherDecode (renderCanonicalJSON jsval) == Right (toAeson (canonicalise jsval))
+    eitherDecode (renderCanonicalJSON jsval) === Right (toAeson (canonicalise jsval))
 
 canonicalise :: JSValue -> JSValue
 canonicalise v@JSNull        = v
@@ -48,6 +56,9 @@
 canonicalise   (JSObject vs) = JSObject [ (k, canonicalise v)
                                         | (k,v) <- sortBy (compare `on` fst) vs ]
 
+sanitizeString :: String -> String
+sanitizeString s = Text.unpack (Text.replace (Text.pack "\\") (Text.pack "\\\\") (Text.pack (show s)))
+
 instance Arbitrary JSValue where
   arbitrary =
     sized $ \sz ->
@@ -55,9 +66,9 @@
       [ (1, pure JSNull)
       , (1, JSBool   <$> arbitrary)
       , (2, JSNum    <$> arbitrary)
-      , (2, JSString . getASCIIString <$> arbitrary)
+      , (2, JSString . sanitizeString . getASCIIString <$> arbitrary)
       , (3, JSArray                <$> resize (sz `div` 2) arbitrary)
-      , (3, JSObject . mapFirst getASCIIString .  noDupFields <$> resize (sz `div` 2) arbitrary)
+      , (3, JSObject . mapFirst (sanitizeString . getASCIIString) .  noDupFields <$> resize (sz `div` 2) arbitrary)
       ]
     where
       noDupFields = nubBy (\(x,_) (y,_) -> x==y)
@@ -78,7 +89,11 @@
 toAeson (JSNum n)     = Number (fromIntegral n)
 toAeson (JSString s)  = String (fromString s)
 toAeson (JSArray xs)  = Array $ V.fromList [ toAeson x | x <- xs ]
+#if MIN_VERSION_aeson(2,0,0)
+toAeson (JSObject xs) = Object $ KM.fromList [ (fromString k, toAeson v) | (k, v) <- xs ]
+#else
 toAeson (JSObject xs) = Object $ HM.fromList [ (fromString k, toAeson v) | (k, v) <- xs ]
+#endif
 
 instance Arbitrary Int54 where
   arbitrary = fromIntegral <$>