Leaving packages at a fixed version and patching them is a terrible idea. This is a Linux mindset and while it was fun for a few years it does not scale and it

Leaving packages at a fixed version and patching them is a terrible idea. This is a Linux mindset and while it was fun for a few years it does not scale and it is not sane. You're effectively forking the software by diverging from upstream and then you have the fun of creating new security vulnerabilities by incorrectly backporting fixes. Go look at the update history for Apache HTTPD on RHEL -- this has happened several times in the past. That said, since FreeBSD 10.0 there is now a stable "quarterly" branch which is enabled by default. The goal is to relieve you from the rolling release trauma for 3 months at a time. You get security and bug fixes: if it's very trivial, it's a backported patch; if it's a minor update, we will not hesitate to do that instead; if it's a major update and we don't trust backporting the fix, we push that update. The goal is to prevent major changes that could break compatibility or default behavior when possible, but that's not always achievable. Anyway, it works pretty well. We will continue to strive to be better, but it's very usable. We heavily rely on the community for feedback and notification if something has been overlooked. Please try it out and let us know if you have any problems.