The distinction here is on application vs library, IMO. I basically agree that applications, as a default, `==`'ing everything makes sense.

For libraries, having loose bounds might mean that users upgrade and hit issues due to a lack of an upper bound. But given how lightly maintained most projects are, the risk of upper bounds simply getting in the way are higher IMO.

(Put an upper bound if you know of an issue, of course!)

It's a bit tricky though. Django deps in particular tend to want to explicitly check support for newer versions, but the more I think about it the more I ask myself if this is the right strategy