In general, for undiscovered CVEs new versions will be as exposed as old versions - if the bug was not discovered, it was not fixed as well; and if the latest v

In general, for undiscovered CVEs new versions will be as exposed as old versions - if the bug was not discovered, it was not fixed as well; and if the latest version fixes an exploitable security flaw then there generally will be a CVE issued along with that release. Using the same log4j as an example, all the (many!) projects which were still using the old 1.x log4j branch were not exposed, but those who were using the latest released version were exposed to the undiscovered CVE at the moment it was released. IMHO a reasonable compromise is to watch for discovered CVEs and update your dependencies when appropriate, but keep them pinned if no known CVEs apply.