> I think taking the last is problematic: it seems much safer to me to take the one closest to what the author of that code tested with.

If someone doesn't respect semantic versioning the difference of one minor or few minor versions is irrelevant.

> For what it's worth, I think I do understand what cargo is doing, and why, and I completely respect that approach.

I think understanding SemVer would help a long way.

I get down voted but look at this https://go-review.googlesource.com/c/vgo/+/95700/4/vendor/cm...

hard coding v1 and v2 check, anyone who understands semvar would never make such mistake!