[ag_dubs]

this would primarily be for people who use their own internal packages in developing their own applications, i.e. a single author owns both packages.

that being said, it turns out that the semver handshake the community does works Most of The Time, so if it is a trusted dependency it wouldn't be that dangerous. assuming you also had tests-dependent deploy, the tests would catch the break.