Here is a paper describing google3
https://research.google/pubs/why-google-stores-billions-of-l..., which includes the policy that “To prevent dependency conflicts, as outlined earlier, it is important that only one version of an open source project be available at any given time.” More documentation on The One Version Rule for third_party:
https://opensource.google/documentation/reference/thirdparty.... This rule may make it more difficult to upgrade a third_party library frequently since the maintainer of the third_party library has to test all the uses of the library from all teams, rather than each team deciding when to upgrade.