The current REQUIRE specification allows for upper bounds to deal with this.
The only issue there is an upper bound by any reverse-dep package holds the package back for all other uses. Using a per-project separate sandbox might help with that, as in virtualenv, which we don't have a single standard way of doing just yet. Setting JULIA_PKGDIR works as a decent approximation.
