> 1. Get approval from the open source team (for each minor version). > 2. Start a security approval process (for each minor version). > [etc...] Out of curi

> 1. Get approval from the open source team (for each minor version). > 2. Start a security approval process (for each minor version). > [etc...] Out of curiosity, do you think having a laborious process to adopt even minor versions actually improves security? Because to me, since in most software exploitable bugs are often fixed without being explicitly marked as such or CVE-ed, this seems like basically a recipe for insecurity. I could be wrong. And I know that even if you disagreed with the process, that wouldn't mean that you didn't have to follow it, or that many, many developers in a multitude of environments similar to yours don't have to follow similar processes. But I'm curious what you think.