this isn't a package

Ah, I see the problem. The problem is that I didn't use the qualified notation for adding the plutus-ir dependencies, so the script isn't updating them. I think the right fix is instead to use plutus-core:plutus-ir instead of plutus-ir; the script handles that. OR to just omit the version bound when depending on plutus-ir from inside plutus-core, which is what we mostly do elsewhere when depending on components inside the current package (since the version bound does nothing in that case).

If you'd written a comment about the problem I wouldn't have had to reverse-engineer it :)

Good point, I didn't realize we can write plutus-core:plutus-ir

I think the simplest thing would be to remove the version bounds from the internal deps in plutus-core: we have the same problem with e.g. plutus-core-testlib being used without the plutus-core: and with a version bound.

Fortunately plutus-core-testlib starts with plutus-core 😂
The thing is the script will add the version bounds back, so the script will need to be modified. I'll do that separately - don't want it to block the release