Restricting the version of an indirect dependency

The HTTP package is not in my project file, but I would like to restrict its version and upgrade everything else. I have not been able to find a direct way of doing this, so I upgraded everything, then added it to my project with a version restriction and then deleted it from the project again, i.e. using Pkg pkg"up -m" pkg"add HTTP@1.10" pkg"rm HTTP" Is this the best way to do this?