On an aside, the MVS (minimum version selection) is an interesting and understandable algorithm for dependency resolution. Started from Go, CUE uses it now too.
It's wild to me that MVS didn't get picked up everywhere else for their next-gen package managers. Picking up "fixes" automatically turned out to be a boondoggle, if not a security risk. There's no reason we need to write a SAT solver just to manage our library dependencies.
https://research.swtch.com/vgo-mvs