Libraries that don't do point-release security updates for major versions should not be trusted, or used in production. Libraries that do release security upda

Libraries that don't do point-release security updates for major versions should not be trusted, or used in production. Libraries that do release security updates, but introduce new language features like generics in those point-releases also shouldn't be trusted, and have no place in production. Why should I upgrade my language version to get a security fix?