You cannot even guarantee point releases don't contain breaking changes. Nor can you assume they don't include new security vulnerabilities. When deploying sof

You cannot even guarantee point releases don't contain breaking changes. Nor can you assume they don't include new security vulnerabilities. When deploying software in a production environment you should never deploy anything which hasn't first been tested through your CI pipeline and/or been through it's paces in your dev and test environments before deploying to prod. In fact many engineers running on security systems will version lock even the point release for safety. This is particularly true when working with smaller projects or packages in node / Go / whatever. In fact there was a case recently about someone who took ownership of a popular Python (I think it was) module, inserted malware and just upped the point release. So in summary: no, you cannot even guarantee that point releases are safe.