The depset(direct=...) constructor that we have been recently migrating users towards does not apply the same element validity checks as the legacy depset([...]) constructor. Consequently one can insert mutable items such as structs and tuples containing lists:
x = [1, 2, 3]
s = depset(direct = [(x,)])
print(s) # 'depset([([1, 2, 3],)])'
x.append(4)
print(s) # 'depset([([1, 2, 3, 4],)])'
The fix is to apply the same checks as done by the legacy constructor, but this is a breaking change. The new check will thus be behind a flag called --incompatible_always_check_depset_elements.