You are correct. Got too used to the "just add everything to regular dependencies" shortcut in private projects, which doesn't cut it for published modules.