Release no later than 6 weeks after any of your dependencies releases a higher version. Time is important, not just how many versions behind, because a dependency tree that is up to date at each point in time is more likely to be internally consistent and compatible.

If your library does not have the investment necessary to keep up to date with dependencies, advise consumers to move to a library that is kept more up to date.