> You should pin your dependencies, and updates of everything - including build tools - should be explicit steps in the process. Yes, and in the not uncommon c

> You should pin your dependencies, and updates of everything - including build tools - should be explicit steps in the process. Yes, and in the not uncommon case where part of the build environment is left unspecified, the untouched code accrues debt over time. As you say, it's possible not to take on that debt by making a significant investment up front. This isn't an argument against the debt metaphor, it's an argument for it. > Vulnerabilities aren't sins, they are things that can be fine to leave unfixed. My point doesn't change if you s/vulnerability/sufficiently serious vulnerability/.