Your use of target_link_libraries() is indeed problematic, as it involves two different “flavors” of this command, a traditional and a newer one.
In one use, you specify the dependency is PRIVATE; in the other, you specify nothing. That’s not acceptable: Either you specify PUBLIC/PRIVATE/INTERFACE for all elements, or for none.
So, you can fix your CMakeLists.txt to say either:
target_link_libraries(my_prog foo bar)
target_link_libraries(my_prog baz)
or
target_link_libraries(my_prog PRIVATE foo bar)
target_link_libraries(my_prog PRIVATE baz)