Whilst this is true, it&#x27;s clearly bad practice to have a &#x27;latest&#x27; dependency in any module that is itself designed to be depended upon.<p>Personally I&#x27;ve never seen this be a problem in practice. Possibly because I&#x27;m lucky, possibly because I&#x27;ve only used dependencies that don&#x27;t do this. Since I mostly use quite popular libraries, and check the dependencies of the more niche ones I decide to use for exactly things like this, I think the latter is probably the case.<p>Out of curiosity, I wonder if anyone here has hit this problem in practice with npm and could provide a concrete example - in particular with popular open source dependencies?<p>Yes it&#x27;s a possible problem in theory, but a lot of problems in software are possible in theory but rarely occur in practice because people follow sensible patterns to guard against them.