Initially we tried to keep arcgis-rest-js dependencies limited to the common package, but that slipped. So the first step would be to return to this approach and test it thoroughly.
Second step is to switch to 4.x while keeping as much as possible of the change isolated through linking functions (Some aspects of the 3.x->4.x change, such as getting rid of the UserSession authentication class, will not be isolatable.).