It would be easier for the user to use dependencies.json without mentioning the versions to use and IPM get the latest versions for them.