I would never trust a dev defined SemVer as more than a relatively useless indicator of compatibility. I make sure there’s proper unit and integration testing to prevent external dependencies breaking production. If it’s a major dependency I check the release notes every version.
Testing ground for 5 eyes secret police mass surveillance