I think there are three things that combine to cause the underlying problem: 1. Open source creators own the package and they owe you nothing. Most (all?) of

I think there are three things that combine to cause the underlying problem: 1. Open source creators own the package and they owe you nothing. Most (all?) of the major package repositories follow this model. 2. There are very few ways to officially fix a major dependency if the creator(s) take a powder beyond cajoling or forking and attempting to maintain it yourself. 3. Many people are using VERY complex and important packages that, frankly, they may not actually be able to maintain themselves. I fall into this category for some packages that I use and I'm sure most people do, especially on small projects. So, you are left with hoping the OS creator stays on top of things or cajoling. Once cajoling fails, and you are in a bind, a bind that may threaten your job and career; things get ugly. It's not right, but it's human nature and it's predictable. I'm identifying the problem, I really don't have a solution.