Just to play devils advocate, perhaps having everyone synced to the same dependency is a blessing in disguise. Sure, it's awful when a breach is found, but sin

Just to play devils advocate, perhaps having everyone synced to the same dependency is a blessing in disguise. Sure, it's awful when a breach is found, but since it affects everyone simultaneously at least it gets patched immediately. In addition, a hacker has so many choices that your likelihood of being targeted is lower than if it was a specific breach affecting a narrower scope of vulnerable systems. By the time you're targeted there's time to implement a patch. Just a voice for the benefits of distributed vulnerabilities.