FWIW, I'd like if these tools had an option to prefer the oldest version satisfying the given constraints (rather than the newest, as it is now — probably still a better default).
The problem is there's no metadata for which versions fix security bugs, and therefore which previous versions are now insecure.