The way Cargo pins dependencies always makes me nervous. One of the "new crates" on crates.io has a dependency that is 3 years out of date, rather than dependin

The way Cargo pins dependencies always makes me nervous. One of the "new crates" on crates.io has a dependency that is 3 years out of date, rather than depending on the newest version. It just makes me wonder how many bug fixes aren't getting propagated, potentially spreading serious issues. I realise that the C way of "packages that aren't kept up-to-date just break" is less than ideal, but after the Log4J thing happened I'm wary.