We are building a product with 100s of OSS dependencies. We want to fully comply with the OSS license terms.
Let's assume our product has a direct dependency "DDep_v1" under MPL-2.0 license, and "DDep_v1" itself has a direct dependency "TDep_v1.8" . Now TDep_v1.8 has a vulnerability, which is fixed in TDep_v1.9, and therefore I want to change DDep_v1 to point to TDep_v1.9 (instead of _v1.8). No other changes at all.
Here is the question: Is the mere change of the version of the dependency a modification of DDep_v1 that makes it a 'Derivative Work' with all its implications (notice of modification, etc)?
Are there any publications on this topic?
The question is not limited to the MPL-2.0 license, I just use it here as an example.