- There is a single root dependency somewhere which gets overtaken

- A new version of this dependency is published

- A CI somewhere of another NPM package uses this new version dependency in a build, which trigger propagation by creating a new modified version of this dependency?

- And so on...

Am I getting this right?