3 ms·

And if the upstream developers are unresponsive, or only provide the bump with the latest bleeding-edge version which you can't upgrade to yet?

• Wowfunhappy 5y ago
  On a system where security is critical, I would probably need to re-evaluate my use of that software. It doesn't necessarily need to be the upstream developer, it could be some other organization analogous to a distro maintainer. What matters is that someone who is familiar with the software and code base has actually tested the update in a purposeful way.