You have at least two more options than that: - don't have the dependency in the first place - supply your own dependencies instead of relying on the environm

You have at least two more options than that: - don't have the dependency in the first place - supply your own dependencies instead of relying on the environment to provide them for you in ways you can't control The ideal format for distributing software is a single, self-contained executable program far more often than parts of the developer community would like to admit. So many of these potentially serious problems just don't exist if you use a compiled language and you statically link a controlled set of dependencies at build time. Obviously you still need to monitor your dependencies for essential updates and then issue updates of your own software to incorporate them when necessary, for example in the event of a security vulnerability being identified and fixed. And obviously you may still depend on services provided by your host environment that you're communicating with but not incorporating directly. But at least you always know exactly what your user will be running within your own program, you can test it properly before you ship it, and it won't then mysteriously change because of something they or some other software on their system did that you have no knowledge about or control over.