I do not think this dependency is justified. If anything, up2date should depend on firstboot. It seems that what happens is that up2date installs a bunch of components into /usr/share/firstboot/modules. I may be mistaken, but it looks that way. In any case, up2date should be removable from Fedora Core 5, and it isn't.