我正在开发一个依赖于许多第三方板条箱的项目。正如它经常发生的那样，第三方板条箱依赖于其他人。
我经常发现自己处于这样一种情况，两个或两个以上的板条箱需要同一个板条箱的不同版本。因此，cargo无法选择版本。通常，有问题的板条箱是那些我没有明确添加的板条箱。
同时，唯一的解决方案是检查第三方并在那里更新版本，但它通常需要更新整个第三方链。这需要时间，不好玩。当我试图将我的更改发布到上游时，合并它们需要很长时间。
在Rust中有没有更好的方法来处理这种情况？
P.S.我来自C++背景，依赖管理更糟糕。所以，我没有太多的经验与花式现代生态系统，可能会错过一些东西。
为了给予更多上下文，我添加了一个部分（完整版本非常长）cargo tree输出。
这是我添加新依赖项之前的树：

│   ├── near-chain-configs v0.0.0 (https://github.com/f-squirrel/nearcore.git?rev=76424c004de84f6b5823751f132f62a0da9aa656#0a8e7ac7)
    │   │   ├── anyhow v1.0.75 (*)
    │   │   ├── chrono v0.4.26 (*)
    │   │   ├── derive_more v0.99.17 (proc-macro) (*)
    │   │   ├── near-config-utils v0.0.0 (https://github.com/f-squirrel/nearcore.git?rev=76424c004de84f6b5823751f132f62a0da9aa656#0a8e7ac7)
    │   │   │   ├── anyhow v1.0.75 (*)
    │   │   │   ├── json_comments v0.2.1
    │   │   │   ├── thiserror v1.0.47 (*)
    │   │   │   └── tracing v0.1.37 (*)
    │   │   ├── near-crypto v0.0.0 (https://github.com/f-squirrel/nearcore.git?rev=76424c004de84f6b5823751f132f62a0da9aa656#0a8e7ac7)
    │   │   │   ├── blake2 v0.9.2 (*)
    │   │   │   ├── borsh v0.10.3 (*)
    │   │   │   ├── bs58 v0.4.0
    │   │   │   ├── c2-chacha v0.3.3
    │   │   │   │   ├── cipher v0.2.5
    │   │   │   │   │   └── generic-array v0.14.7 (*)
    │   │   │   │   └── ppv-lite86 v0.2.17
    │   │   │   ├── curve25519-dalek v3.2.0 (*)
    │   │   │   ├── derive_more v0.99.17 (proc-macro) (*)
    │   │   │   ├── ed25519-dalek v1.0.1
    │   │   │   │   ├── curve25519-dalek v3.2.0 (*)
    │   │   │   │   ├── ed25519 v1.5.3
    │   │   │   │   │   └── signature v1.6.4

这是我添加的依赖项：

[dependencies]
iota-sdk = "1.1.0"

我收到的错误：

error: failed to select a version for `signature`.
    ... required by package `ecdsa v0.16.0`
    ... which satisfies dependency `ecdsa-core = "^0.16"` of package `k256 v0.13.1`
    ... which satisfies dependency `k256 = "^0.13"` of package `iota-crypto v0.21.2`
    ... which satisfies dependency `iota-crypto = "^0.21.2"` of package `stronghold_engine v2.0.0-rc.0`
    ... which satisfies dependency `engine = "^2.0.0-rc.0"` of package `iota_stronghold v2.0.0`
    ... which satisfies dependency `iota_stronghold = "^2.0.0"` of package `iota-sdk v1.1.0`
    ... which satisfies dependency `iota-sdk = "^1.1.0"` of package `iota_client v0.1.0 (/my_lib/iota_client)`
    ... which satisfies path dependency `iota_client` (locked to 0.1.0) of package `lib_my_lib v0.1.0 (/my_lib/lib_my_lib)`
    ... which satisfies path dependency `lib_my_lib` (locked to 0.1.0) of package `my_lib v0.1.0 (/my_lib/my_lib)`
versions that meet the requirements `^2.0, <2.1` are: 2.0.0

all possible versions conflict with previously selected packages.

  previously selected package `signature v2.1.0`
    ... which satisfies dependency `signature = "^2"` of package `ed25519 v2.2.2`
    ... which satisfies dependency `ed25519 = "^2.2.0"` of package `ed25519-zebra v4.0.3`
    ... which satisfies dependency `ed25519-zebra = "^4.0.1"` of package `iota-crypto v0.23.0`
    ... which satisfies dependency `iota-crypto = "^0.23.0"` of package `iota-sdk v1.1.0`
    ... which satisfies dependency `iota-sdk = "^1.1.0"` of package `iota_client v0.1.0 (/my_lib/iota_client)`
    ... which satisfies path dependency `iota_client` (locked to 0.1.0) of package `lib_my_lib v0.1.0 (/my_lib/lib_my_lib)`
    ... which satisfies path dependency `lib_my_lib` (locked to 0.1.0) of package `my_lib v0.1.0 (/my_lib/my_lib)`

failed to select a version for `signature` which could resolve this conflict

更新：

在添加新的依赖项以更新signature的版本（由Kevin Reid建议）之前，我曾尝试运行cargo update，但它没有更新版本。