Add dependencies for packages that are not exposed in the API

[bvssvni]

Sometimes a library is only used internally. This means that when the dependency breaks, it is not necessary to bump the first non-zero number, but bump the patch number instead.

[bvssvni]

There is problem, though. Only because Eco recommends updating the patch number does not mean that it is correct. There could be breaking changes in the library. This might increase the chance of human error.