That’s definitely counter-intuitive for me, but you’re right, that would at least give a single spot where a particular dependency’s version is defined. Harder to find where that one spot is, but probably still easier than managing it in multiple places.
By that thinking, InputBox should be able to remove its dependency on Anvil Extras, right, since it depends on Validator and Validator includes Anvil Extras.