… and the only reason that got updated is because you originally had only one update button, if you were to update now and use the “update emonBase” button (I assume you have and emonbase not and emonpi from your opening line) paho-mqtt would not get updated, that is exclusive to “update emonpi” button users only (see Update EmonPi Button or Update EmonBase Button? - #15 by pb66).
[edit] Likewise with the nodered-emoncms-module, that only gets installed via the “update emonpi” button too.