@domi @wolf480pl And as for dealing with the security feed firehose… well distros are a thing for a reason, and they can deal with it at scale pretty well due to sharing the work between people.

Which is why version pinning is an awful idea, no only it means you're very unlikely to ever check updates for things like obvious malware, but it also means having to deal with version bumps in each projects (and you typically don't only have a single one) and it feels like a stupidly menial task.