Not quite. Library authors are expected to specify the version that they tested with. (Or the oldest version that they tested with that works.)

If it's an old release of a library then it will specify old dependencies, but you just have to deal with that yourself, because library authors aren't expected to have a crystal ball that tells them which future versions will be broken or have security holes.