> As a practical matter, software that is network-accessible or deals with data from outside sources may well need a security patch from time to time. This is

> As a practical matter, software that is network-accessible or deals with data from outside sources may well need a security patch from time to time. This is as good argument as any for allowing the dependencies to be updated without updating the main software.