Ordered list of necessary dependency updates

E..g com.google.foo needs to upgrade jsr305 to 3.0.2
...

start at the bottom of the dependency tree and work our way up.
How much of this can be farmed out?
Can this be autogenerated from the zeroth order dependency list?

This needs the zeroth order dependency list first.

see #30