diff --git a/cabal-bounds-upper.project b/cabal-bounds-upper.project
index c865f96..829d485 100644
--- a/cabal-bounds-upper.project
+++ b/cabal-bounds-upper.project
@@ -20,7 +20,7 @@ constraints:
   , bytestring == 0.12.1.0
 
     -- https://hackage.haskell.org/package/cassava
-  , cassava == 0.5.3.1
+  , cassava == 0.5.3.2
 
     -- https://hackage.haskell.org/package/directory
     -- GHC boot library
diff --git a/project/TODO.md b/project/TODO.md
index 3a81c48..90e238e 100644
--- a/project/TODO.md
+++ b/project/TODO.md
@@ -17,9 +17,12 @@ Components:
 
 ## Compatibility
 
+* [`hashable`](https://hackage.haskell.org/package/hashable)
+  `1.5.0.0` is blocked by
+  [`async`](https://hackage.haskell.org/package/async), a dependency of
+  [`typed-process`](https://hackage.haskell.org/package/typed-process).
 * [`tasty`](https://hackage.haskell.org/package/tasty)
-  `1.5.1` is effectively disabled by constraint `base <0` made in revision 1,
-  but it is not marked as deprecated.  See issue
+  `1.5.1` is deprecated.  See issue
   [#421](https://github.com/UnkindPartition/tasty/issues/421).
 
 ## Documentation