Elsewhere, it happens in large projects where two direct dependencies themselves depend on different versions of the same library.  I haven't had this happen to me in CL, but I expect it to happen if exact version matching were to become prevalent.

In reading this list, and elsewhere, I understand that versioning becomes controversial.  I've experienced both sides of the problem where you either under or over specify the versions of dependencies.  Exact version matching is a useful tool to limit the impact of upstream changes.  However, it does induce trivial domino-updates.  At Amazon, I got used to some tooling and process that reduces the overhead, while also seeing the turmoil caused by teams having to support old versions (they'd pinned/used-exact and would never have "the resources" to update).