> You're protected, but it also means you can never upgrade anything. You're protected, and it means you have to test your system _before_ upgrading. Also, I

> You're protected, but it also means you can never upgrade anything. You're protected, and it means you have to test your system _before_ upgrading. Also, I think I'm working with a much broader definition of what "a dependency" is than you are. I consider `Alpine Linux 3.16.2` to be an atomic thing; I don't try to track the state of every single binary that comes along for the ride. But if I depend on something to be executable from my application, like `ffmpeg 5.1.2` or whatever, I _would_ version lock that, and install it myself as part of the build script. Then, when `Alpine 3.17` or `ffmpeg 5.2` comes out, I can bump to those versions, run our integration tests, and verify nothing broke.