How to specify package version in package.xml or rosdep depends.yaml

edit

Please see if #q207735 answers your question.

Note btw that version info is currently not used by rosdep and friends. It's only used when generating binary packages (such as debs and rpms) on the buildfarm to resolve dependencies.

As far as I know there is currently no way to get rosdep to install specific versions.

As you write, the find_package(..) calls can require specific versions in your CMakeLists.txt.

PS: depends.yaml is a rather old piece of infrastructure. I'm not sure that is still universally supported these days.

Edit:

Could you give me some more pointers about your comment about depends.yaml? We use a 10-custom.list file in /etc/ros/rosde/sources.list.d and this points to a yaml our_server/depends.yaml which defines packages we provide locally. Is that a bad practice?

That is something else. From your comment I understand that you were distributing a yaml file with some extra depends with your sources (ie: as a sibling to package.xml). That is something that is / was actually possible, but I haven't seen it done much more these days.

What you are doing is essentially a locally extended rosdep db. That is perfectly fine, as long as you understand and accept that those dependencies will not be resolvable by people that don't have access to your extension.