For me the question is was the new (breaking) functionality announced when the package was updated. It appears to me it was thus I find no issue. This is diff

For me the question is was the new (breaking) functionality announced when the package was updated. It appears to me it was thus I find no issue. This is different then software announcing on the next release they will include ads or even a crypto miner as part of revenue generation As long as the change is announced then there is no ethical issues and if you as the dev or user fail to read the updates of your depencacy tree well that is a failing on your part