The problem with this approach is that (esp. for hobby projects) updating stuff is a bit tedious. Let's say you have a relatively bare bones project in Rails or a PHP framework you have a couple of dependencies that people usually use together, so upgrading can be quick and painless.

I've now had it several times in the years-long lifespan of small clojure web projects that people have moved on and the thing (framework-ish) basically doesn't exist anymore and going by the issues it only had like 10 users in the first place.

It's not the end of the world, and fortunately there's not a lot of needless churn, but I guess I would prefer to have this "I am trusting project x and I only have to care about their releases (pre-testing all the moving parts) and then my 5 dependencies" and instead I have 20 dependencies/moving parts for my web app.

Yes, I'm lazy and I don't think it's a problem in an env where you have a proper dev workflow anyway.