In practise using latest or just the major version has caused far less wasted effort for our team than scrambling to update versions because of some newly disco

In practise using latest or just the major version has caused far less wasted effort for our team than scrambling to update versions because of some newly discovered CVE. It's a problem in frontend builds because js libs are quite poorly behaved so we fix more there but any backend stuff, be it alpine / debian base images, jvm libs, toolchains so on we've not had an issue with specifying only major versions. Dogmatic rules are wrong 100% of the time.