Upper bounds only make sense if you assume that every package uses SemVer and that the author’s idea of a breaking change is the same as yours, which is a giant assumption that a package manager should not be making.