Hacker News Reader

Different actors have significantly different security preferences / concerns and risk/reward profiles with respect to new features. Almost everyone could be following it -- everyone, if you trust the vendor actually dogfoods -- and it would still work.

I wait a few months. Someone else only waits a week.

Updating to the latest version and running it shouldn't be how you review them for dependencies. You can follow the development of a few packages you care about and review them immediately, while not blindly running cutting-edge everything at all times.

It itsn't depending on everyone not following it, it is just incomplete; you should review the code or wait for someone you trust to review the code or ,,,do what GP recommends.