> Individual projects should be able to upgrade dependencies separately.

No, that way lies sorrow and despair. There should only be one version of any dependency being used in your company. Any deviations should require like VP-level approvals or something.