diff --git a/pom.xml b/pom.xml
index 1ae6e8f896..df7575e241 100644
--- a/pom.xml
+++ b/pom.xml
@@ -52,7 +52,7 @@
     <!-- Should only need to override these if using timestamped snapshots: -->
     <jenkins-core.version>${jenkins.version}</jenkins-core.version>
     <jenkins-war.version>${jenkins.version}</jenkins-war.version>
-    <jenkins-test-harness.version>2.22</jenkins-test-harness.version>
+    <jenkins-test-harness.version>2.23</jenkins-test-harness.version>
     <hpi-plugin.version>2.0</hpi-plugin.version>
     <stapler-plugin.version>1.17</stapler-plugin.version>
     <java.level>7</java.level>
@@ -321,7 +321,7 @@
         </plugin>
         <plugin>
           <artifactId>maven-enforcer-plugin</artifactId>
-          <version>1.4.1</version>
+          <version>1.4.2.jenkins-1</version> <!-- TODO update to official 1.4.2 or 3.0.0 when available -->
         </plugin>
         <plugin>
           <artifactId>maven-install-plugin</artifactId>
@@ -526,6 +526,14 @@
                   <message>No Snapshots Allowed For Release Versions</message>
                   <onlyWhenRelease>true</onlyWhenRelease>
                 </requireReleaseDeps>
+                <requireUpperBoundDeps>
+                  <excludes>
+                    <exclude>com.google.guava:guava</exclude> <!-- TODO Stapler requests 14 while Jenkins requests 11; should backdate the Stapler version -->
+                    <exclude>commons-logging:commons-logging</exclude> <!-- TODO jenkins-test-harness-htmlunit requests 1.2, newer than 1.1.x in core -->
+                    <exclude>com.google.code.findbugs:jsr305</exclude> <!-- Stapler requests 2.x while core requests 1.x; anyway not used at runtime -->
+                    <exclude>org.kohsuke:access-modifier-annotation</exclude> <!-- needed between Jenkins 2.36—2.60 -->
+                  </excludes>
+                </requireUpperBoundDeps>
               </rules>
             </configuration>
           </execution>