The package name validation was wrong for product target dependencies (.product(name: "<product>", package: "<package>")) as we were ...