> People didn't actively go seek out a new version. They did. They chose not to pin their dependency versions, so this is their clear explicit choice. They al

> People didn't actively go seek out a new version. They did. They chose not to pin their dependency versions, so this is their clear explicit choice. They also chose not to test their dependency updates before pushing it through to their end users, pure negligence by e.g. AWS who was affected by this.