In addition to the existing smackspec syntax
which specifies that the user will only refer to "v3", it would be helpful to have a "minimum" syntax, like this:
require: cmlib v3 (v3.19.12)
which says that v3 will satisfy their constraints, but that it must be at least v3.19.12 (this only makes sense when the constraint - v3 in this case - satisfies the minimal version - v3.19.12 in this case). This is the same as the common semantic version constraint pattern "<4.0.0 >=3.19.12" seen in other tools.
Once this syntax was in place, the "resolve dependencies" code could be made slightly more complicated in order to notice the case where, while 3.19.12 is required and 3.30.0 is available, 3.24.4 is already installed in the system, so there's no need to get the most recent version.