ok, i expanded this a bit: the concern i had about not getting the declared version applies to both an explicit package mapping and to fetching the artifacts:
https://github.com/pantsbuild/pants/issues/13152 … but i still think that we should probably have a mapping, in order to avoid needing to fetch all of thirdparty to compute any dependencies.