> When this list goes large, you have to keep track of the state of the every dependency you include. Bugfixes, security patches.. However, in regular package m

> When this list goes large, you have to keep track of the state of the every dependency you include. Bugfixes, security patches.. However, in regular package managers, you can also depend on libraries. And this solves a lot of headache, since those packages are shared globally and updated by system. And this is the back-and-forth problem that nobody has the answer for. Do we make this one app fail, because the maintainer for it isn't updating for library updates? or do we cause system-wide insecurity because we need that one app to work? I'm in favor of the former, but I think both sides have good arguments.