Comment by fpoling

Any library in Rust comes with Cargo.toml file listing dependencies and their versions. Rust build system allows to use later versions of the libraries so presumably an application that uses an old library will have dependencies for the library updated.

The problem is that sometimes library may need to pin a dependency version. Or a dependency was released with a newer major version update and do not back-port security fixes to older versions.

So one cannot just use an old library. Its dependency list must carefully considered.

Now this problem exists with any package management system. But in Rust it is more visible as the language still evolves quickly with non-trivial new features released often.

Then the library authors may want to use newer language features on their API. Then they simply bump the library mayor version and maintain only that. So an old dependencies will not get updates.