Crates don't add new APIs every day, but if you allow a revert to a 5-year-old version, there will definitely be an API difference. I know that without testing

Crates don't add new APIs every day, but if you allow a revert to a 5-year-old version, there will definitely be an API difference. I know that without testing you don't know which version exactly is the right one, but it's safer to err on the latest side, than the oldest side. Serde specifically had an issue with exposing and renaming some APIs that were meant to be private and got used in other crates (let's not even get into how that relates to semver, and whose fault was that), so IIRC serde 1.0.123 is the lowest version you can safely allow these days.