however, I think the more common case is that they set it to the latest bounded by a minor or patch version (as opposed to a major version) as defined by semvar.

at least that seems to be quite common in the npm/js world.