Conversation

@lachs0r

Well, yes, but what's the alternative you're suggesting?

This is why it's important to depend on well-maintained libraries.

If they have good reasons to depend on different versions, they can technically do that.

If that means they're inheriting a security risk from one of their dependencies, though, then it becomes their issue (and yours by inheritance) to deal with.