I think it’s the app developer’s responsibility to reconcile dependency versions. Pushing it over to maintainers of these dependencies just adds development and maintenance overhead. Maybe it’s a bit forced example, but I can’t remember any better one now. Take Svelte and SvelteKit. When making a typical “Svelte app” you usually need both packages. @sveltejs/kit has svelte as a dev dependency but in your package.json you need to include both, and thus the responsibility of maintaining and reconciling their versions lies on you, the app developer.
What I’m trying to say is that I think including both packages explicitly shouldn’t be considered a DX problem or some shortcoming of library/framework.