How not to indirectly depend on multiple versions of the same package?