dependency version management pushed up to parent