Being alerted is good. Not necessarily sufficient though. Dependency A depends on C.v2. Dependency B used to depend on C.v2 but just upgraded to C.v3. Either y

Being alerted is good. Not necessarily sufficient though. Dependency A depends on C.v2. Dependency B used to depend on C.v2 but just upgraded to C.v3. Either your language (or _maybe_ tooling) allows those to coexist or you are now going to have a really bad time and give serious thought to jettisoning one of A or B.