I think dependencies on libraries should be very specific in the version they use.
Dependencies of dependencies are still a bit of a trick, though. Should they be shared? What if you want to provide a customized / mocked version of a library to a library you use?