I agree with your statement, but what I usually see in real life is that once dependencies are vendored in they never change.
That's what dynamic linking and Linux distributions are for.
That's what dynamic linking and Linux distributions are for.