I dont know if this is the 'good-practice' way to do this, but it seems much less error prone to me to depend on each package in only one project. dotnet should handle implicit references.
This commit references (almost) each package in the lowest level it's needed, and assumes implicit references on above levels.