I agree with you: this is a good practice. However, what I was speaking about is the version handling of (sometimes direct but mostly) indirect dependencies.

I agree with you: this is a good practice. However, what I was speaking about is the version handling of (sometimes direct but mostly) indirect dependencies. The domain of `composer why` and `composer why-not`. One if the most speaking example I can think of is: if two libs depends on guzzle 5, then you can't update only one on a version that depends on guzzle 6: you must upgrade both at the same time. Each to an intercompatible lock on guzzle version.