I believe that's usually so they can track when a library has a security vulnera...

		mook 1 day ago \| parent \| context \| favorite \| on: Debian's approach to Rust – Dependency handling (2... I believe that's usually so they can track when a library has a security vulnerability and needs to be updated, regardless of whether the upstream package itself has a version that uses the fixed library.