The module spec lets you put the minimum version in it; so the scenario you raise in your second paragraph would not happen. The import paths are just there to allow you to have both v1 and v2 in the same project (ideally during a migration period).
You would have to raise the minimum version in your module spec to get a newer version of the dependency.
You would have to raise the minimum version in your module spec to get a newer version of the dependency.