> The sanest, of course, is to not update your dependencies unless really necessary, to avoid introducing new bugs. So instead you live with all the existing (

> The sanest, of course, is to not update your dependencies unless really necessary, to avoid introducing new bugs. So instead you live with all the existing (and unknown) bugs and security issues? And when you finally do update those frozen dependencies it becomes a nightmare because of all the drift, not just in that package but also its dependencies. You should be updating regularly; if you're concerned about stability then stay a release or two behind latest but that's not guaranteed to more stable than latest. Too often I see people take the approach you're espousing to only suffer more later when they are forced to take an update, and then they become so scared of future updates that they never update again, manually backporting patches, and creating a nightmare legacy application.