I think Kevin once started the discussion if a package create is responsible for keeping up to date with all transient dependencies. I think it's a hard one. Because I also think that updating dependencies to newer versions could be seen als breaking changes for instance