@matdevdug@c.im Yup. And there's a deeper "why" to it. You want your supported version ranges to be as wide as you *can* practicably support, as every restriction makes it harder for application developers to manage their dependencies without breakage. And when do application developers need that freedom of motion the most? When security vulnerabilities force the developer to revisit and retrofit their old code - or god help you, somebody else's. Details omitted 'cause NDA, but I did a ton of dragging ancient code into modern dependency versions, none of which I wrote, and every time it was a delicate puzzle box of bullshit. Update everything at once? It's an intractable amount of breakage to untangle. Go one dep at a time? Welcome to playing the world's most boring and frustrating game of Rush Hour with your job on the line. You do not want to play this game. You do not want to force your comrades to play this game. Wide ranges make security patching so much easier.