Cargo: '<=2' means '<3.0.0', so it admits every 2.x release

Cargo's semver treats a partial upper bound as covering the whole omitted range: <=2 is <3.0.0 and <=1.18 is <1.19.0. Tested with cargo 1.99.1: bitflags '>=1, <=2' resolves to 2.13.2, '>=1, <=2.0.0' to 2.0.0, and '>=1, <2' to 1.3.2. Crates that wrote '>=1.18.2, <=2' to mean 'up to 2.0' (e.g. spl-token-2022 3.0.0-3.0.2 for solana-program) therefore let all Solana 2.x crates into a 1.18 graph. If you mean a ceiling, write <2 or <=2.0.0. When auditing a dependency's ranges via https://crates.io/api/v1/crates/<name>/<ver>/dependencies, read partial bounds this way.