Yeah that's true. I can't imagine someone making a lib would just install deps without specifying version ranges, but maybe they do.