You only need one hole. A newly introduced vulnerability compromises the system as soon as one package updates. A fixed dependency only works when every single

You only need one hole. A newly introduced vulnerability compromises the system as soon as one package updates. A fixed dependency only works when every single program is updated.