Recently I discovered a problem I was completely unaware of with dependencies management using semantic versioning patterns. My invalid understanding was that i

Recently I discovered a problem I was completely unaware of with dependencies management using semantic versioning patterns. My invalid understanding was that if I specify a dependency pattern: foo-lib >= 1.0, < 2.0 I will always update to the newest 1.X.Y version of the foo-lib. This is not the case, such pattern can silently install one of the older 1.X.Y releases due to the requirements of other libraries that my software uses and that are out of my control. This is pretty dangerous, the pattern treats all 1.X.Y as equally good for me, but X and Y updates can contain important, often security related bug fixes. A safer way would be to be able to say: I want to have the newest 1.X.Y, fail if it is not possible, so I can investigate.