Cargo Publish uses different dependency version

When I do cargo publish of my library it fails to compile the project because for a some reason it uses different version of a dependency. But if I do cargo build it works fine.

I see that for cargo publish it uses two different version of one of the dependencies:

   Compiling bitcoin v0.27.1
   Compiling bitcoin v0.28.1

And it fails later because one of the dependencies uses 0.27.1 and another 0.28.1.

The dependency is specified as bitcoin = "=0.27.1" in Cargo.toml. If I look into Cargo.lock file I see only version 0.27.1. I.e. only one entry, no other versions in Cargo.lock. cargo tree shows only version 0.27.1 as well. And cargo build uses only 0.27.1 for compilation.

It's absolutely unclear where from the 0.28.1 comes from during the cargo publish

How I can tell cargo publish to not use 0.28.1 and stick to version in the Cargo.lock? I tried --locked and --frozen but I doesn't make any effect.

UPDATE One of the dependencies has defined bitcoin = ">= 0.27" and it seems that Cargo tries to use the most up-to-date version 0.28.1 only because it fits that criteria for that lib. And 0.27.1 for others. That obviously would not work. How to enforce it to use one version?

UPDATE 2: There is the whole tree of the conflicting versions cargo tree --all-features:

├── bitcoin v0.27.1
.
├── emerald-hwkey v0.2.0
│   ├── bitcoin v0.27.1 (*)
│   ├── hdpath v0.6.1
│   │   ├── bitcoin v0.28.1

Where hdpath:0.6.1's Crate.toml accepts any version via:

bitcoin = { version = ">= 0.27", optional = true }

So it's unclear why Cargo tries to upgrade this particular version and makes everything incompatible to each other.

UPDATE 3: It seems that it works if I use a local version of hdpath with enforced ">= 0.27, < 0.28". But I don't want that because hdpath by itself doesn't have a reason for such restriction and works fine with any of the versions.

So I just need to make sure it uses the version compatible with the parent project. Is there any way?