You can do the brute force way I do it with common code. You make sure its copied everywhere you need it. That way an extension is self contained. Nothing is more irritating and confusing (and likely to cause problems for users) than making something dependent on something else to run when it could run on its own. Especially the load order works (someone can always sneak in between your code and your "common" code).
Now if you plan on always delivering your common code with your other code and have that code validate that it is out there before it blows up trying to do something with a message stating it can't run because extension xyz has to also be loaded and your careful to call the original code your overriding (if possible) - then you can get away with what your doing without confusing things.
Personally I like brute force stupid way I do it and just copy any shared functionality - especially because experience has taught me even shared functionality eventually diverges. In my world anyway. Good luck with whatever you decide to do, choose what YOU are most comfortable with.
[And of course I can imagine no greater nightmare than having one up to date and one out of date - safer to just put in common .lua and include with extension.xml]