Ideally the dependency (e.g. a front end component library) should have flags itself but sometimes they execute that poorly (the flag is disabled by default, then removed completely)

The only way I see it possible to completely avoid the problem is by using micro-frontends, toggling should switch to a different build, the build being immutable, it has no problem of dependency changes in it's own context. It is good practice to lock the assets, same s3 files on dev, stage, prod. I saw many pipelines just running another build for prod and that honestly doesn't make sense. It adds uncertainty to how prod will behave. Sorry if I misunderstood your question and went off the rail, it has been a long day for me. ref: https://single-spa.js.org/

Usually for high impact changes, feature flags are a good way to deal with them when doing CD

However in the case of dependent libraries indeed it seems like two bundles would be needed... or at the very least a way to "alias" a dependency of another version under another name

oh wait, looks like its totally doable: https://www.nieknijland.nl/blog/use-multiple-versions-of-an-npm-package-at-the-same-time