Not quite. Library authors are expected to specify the version that they tested with. (Or the oldest version that they tested with that works.) If it's an old

Not quite. Library authors are expected to specify the version that they tested with. (Or the oldest version that they tested with that works.) If it's an old release of a library then it will specify old dependencies, but you just have to deal with that yourself, because library authors aren't expected to have a crystal ball that tells them which future versions will be broken or have security holes.