Library dependency version specifiers aren't for fixing vulnerabilities

Let's say you are the maintainer of a Python library that depends on another Python library like “ urllib3 ”. Because you want to make sure users receive a compatible version of urllib3 you add a version specifier that restricts the version to the current “major” version so users know that older versions aren't compatible. This is what your pyproject.toml might look like: [project] name = "example-library" dependencies = [ "urllib3>=2" , ] Now let's say that urllib3 publishes a vulnerability that affects “v