If you can't go get -u all on your project at least you have done something 'wrong' or your upstreams have done something wrong. First, the upstream behavior;

If you can't go get -u all on your project at least you have done something 'wrong' or your upstreams have done something wrong. First, the upstream behavior; not supporting the published interface (as it was and should therefore work forever) means they need to deprecate that interface and release another with the incompatible changes. However the PROPER way of handling this is to add new versions of exposed public methods and interfaces / constants with new names and only if such a major change is required that you can't support the old interfaces, at THAT point, release at least under a new inclusion path if not new dependency name. Things local a developer might have done wrong: A) include an 'immature' upstream repository that behaves like above. B) use non-public components or other unsafe practices to go beyond the interface contract that was exposed.