Going through the documentation about Package Management, three questions come to my mind:
What happen if a new version of a dependency package “breaks” one application (either directly or indirectly via the dependency chain) and yet is required by another application?
Are all packages stuffed in the same (system) folder or is there the possibility of a choice?
Can a user “freeze” the updating of the packages to a given state/version?
We usually rename the old package, for instance see jasper https://github.com/haikuports/haikuports/tree/master/media-libs/jasper
This means the old package (jasper1) continues to provide what might be required by existing applications, while the new one will be used to compile applications depending on jasper (provided the source is compatible), these applications will depend on the new package (jasper). This should be transparent to the end user, if done correctly.
That said, as anyone can push anything to the HaikuPorts master repositories, it’s possible that this paradigm is broken, ie the old package is not preserved. When you see that happens, please submit a bug report at HaikuPorts.