Yes, I agree that this is a problem. You might be using foo in your project which gets a security update, and two things that depend on foo, where one of those

Yes, I agree that this is a problem. You might be using foo in your project which gets a security update, and two things that depend on foo, where one of those things is using the still-vulnerable-foo. So you now have two versions of foo, including one that is vulnerable. I'm curious to know how other dynamic languages handle this. In Perl I think you generally can't safely load >1 version of the same module, so while you could end up with breakage on an update, you can't end up with the above security problem.