Dependencies validations may be misleading

[facuspagnuolo]

Let's say you are developing an EVM package and publish a version 1.0.0, but then you noticed that there was a problem with something that has nothing to do with the contracts you are providing, e.g. fixing a deployment script or adding a file that was npm-ignored or so. Then, you will have to bump your package.json and publish again. This will make your package.json and zos.json to get unsynched, which means that people trying to link your package as zos link your-evm-package@1.0.1 will fail saying you requested version 1.0.1 but the one in its zos.json is 1.0.0, and the way to circumvent this is to link it using a semver as zos link your-evm-package@^1.0.0.

Which should be the expected behaviour in this kind of scenario? Should we expect the users to bump their zOS project too? What can be improved from the CLI to avoid users publishing unsynched versions of package.json and zos.json files?