> No. You use what they wrote because they allowed you to. It is not then their responsibility what you do with it or how things inconvenience you. It is up to the user to vendor the dependencies and make sure everything works the way it should.

There is also no obligation for you to use or distribute newer versions, even if you are NPM.