Semver 1.0.0 is the first code with an interface stability guarantee, that's it. Whether that correlates with production is up to the engineering team putting

Semver 1.0.0 is the first code with an interface stability guarantee, that's it. Whether that correlates with production is up to the engineering team putting it into production. If they budget for dealing with incompatible interface changes when they want/need to update and they don't have automated untested updates of the dependency, it is entirely reasonable to decide to depend on 0.x in production. In turn, it's entirely reasonable for the owner of the dependency to say, this is fine to go into production (it's stable, secure, feature-complete, etc.), I just have a couple of small planned changes to the interface so I don't want to commit to it yet. Another way of thinking about this: semver doesn't say anything about the current version of the code. It says how that code compares to past and future versions.