The Kotlin version you define when writing a library is the lowest Kotlin version your users can use (safely). If they are worried about security concerns, they can always use a more recent version*.
So, in practice, as a library author, there are two schools of thought:
• either you decide that a user who wants to use an old version of Kotlin should use an old version of your library too,
• either you decide that you want your users to be able to use old versions of Kotlin with the latest version of your library.
In the first case, you always target the latest stable Kotlin version. In the second case, you decide on a time offset (e.g. 2 years), and target the Kotlin version from that long ago, so all users who are less than 2 years out of date on Kotlin can use the latest version of your library.
Of course, if you do that, it means you can't use the new shiny things in your library code. So it's really a choice that you have to make.
*as long as you don't
OptIn
to experimental stuff