Well if upstream doesn't want Debian to ship broken software in a stable version, there's a solution: upstream should improve their quality control and not ship

Well if upstream doesn't want Debian to ship broken software in a stable version, there's a solution: upstream should improve their quality control and not ship broken software in the first place. ;) But I mean, there's no actual obligation to update software. Lots of redistributors don't update to the latest version for many reasons. Apple ships old GNU utilities because they don't like GPLv3. FreeBSD ships an old version of OpenBSD's pf firewall because their patched version is hard to forward-port. OpenBSD ships a truly ancient gcc for a mixture of technical and license reasons. And Debian updates software on a fixed stable-release cycle. I suppose it's fair that upstream can complain about this: GNU and jwz don't have to be happy that people are shipping old versions of their software. But people are also probably not going to stop doing it.