[bunderbunder]

I think that's actually a good thing. Allowing different projects to use different versions of a 3rd-party package may be convenient for developers in the short term, but it creates bigger problems in the long term.

[adrianN]

It depends on the industry. In some places changing a dependency, no matter how trivial the change, entails a lot of work. Think for example about embedded systems where deploying is a lot harder than pushing a Docker image somewhere. It is often far cheaper to analyze whether the fixed bug can be triggered to avoid upgrading unless necessary.

[bunderbunder]

In those situations, why not go ahead and keep the code up-to-date and consistent, and simply not deploy when you don't need to?

[adrianN]

Because that costs money now that could be spent on something that actually produces a profit.