It encourages package creators to simply maintain a master branch instead of creating stable releases, and this can turn into a huge headache down the line. Le

It encourages package creators to simply maintain a master branch instead of creating stable releases, and this can turn into a huge headache down the line. Let's take a recent scenario: the YAML vulnerability in Rails. What if a similar vulnerability is found in a widely-used Go project? Well, you can move to HEAD, but you have no idea what else changed in the meantime. It's impossible to know how your application may break. Or you can try to merge just the security patch, which may not be trivial.