It might be, but this is not malicious. Plenty of projects have pushed breaking changes for one reason or another. I'd argue the only malicious actors here are

It might be, but this is not malicious. Plenty of projects have pushed breaking changes for one reason or another. I'd argue the only malicious actors here are those who do not pin and test their dependencies before shipping updates.