@wolf480pl @jrdepriest @phnt @sjvn To me the way to achieve this is to offload on something like a distro, and then the rest you keep as small as possible so you can keep track of the releases + security announcements of the additional dependencies.

But I don't think that's something most web dev companies can even just understand today, let alone follow.