you want stability (aka reproducibility across a fleet of workstations/servers), but also security updates too, right? but what do you mean by consistency? and

you want stability (aka reproducibility across a fleet of workstations/servers), but also security updates too, right? but what do you mean by consistency? and you don't want to create & distribute a new OS image for every security update, right? ... anyway, the whole problem is that only upstream can provide these kind of security updates. it's a big (and very very convenient) lie what stable distros are doing, but many times packages have to work their asses off to maintain this illusion. (when they have to patch/backport/hack packages.) Rust as language and compiler provides the tools for this (stability guarantee, editions, etc), but the various devs that provide Rust crates might not. sure, if Rust would artificially hold back new features that would definitely provide this "stability", but it's no wonder devs adopt new features fast. because they want them, it makes their life easier, and it usually makes users happier too. what the Rust ecosystem is doing (and NodeJS and TypeScript and quite a few high-velocity newish ones) is providing updates to users faster. of course there are some users that might not care about this, hence debian oldstable, and so on.