A dependency change is any update to a software component that another system relies on, such as a library, model, API, package, or service. Even when the interface stays the same, the new version can change behavior, output quality, performance, permissions, or failure modes. In security work, that matters because downstream workflows often assume the dependency is stable.
Attackers can abuse dependency changes by slipping malicious updates into build pipelines, package registries, or vendor services. Defenders treat them as a risk point: they pin versions, review release notes, test outputs, and monitor for unexpected behavior after upgrades. In AI systems, a model refresh can alter generated text, so code, triage, and policy automation may need fresh validation before trust is restored.