I think that is solved by the vendor thing. You can have two versions of the dependency, e.g. "vendor/dependency" and "vendor/library/vendor/dependency" and, with the caveats mentioned elsewhere (global name conflicts, similar-looking but different types, etc) it should work fine.