this has a side effect: if the dependency is used by another package (and so cannot be removed), it will be updated in the process