Hacker News Reader

That's great until an attacker compromises the automatic update system and uses it as a vector.

That's what cooldowns are for

That's great until you have a public zero-day exploit.

If it's big enough like this one you can always make an exception.

Cooldowns don't apply when you're patching a CVE; like, dependabot vulnerability scanning in GitHub has a separate cooldown from auto-updates

I would wager that far more systems get exploited because they are out of date (sometimes woefully) than by poisoned package repos.

But, certainly do your own threat assessment and develop and implement whatever plan works for you.

This is how you get wrecked by malicious packages being published or other breaking bugs. Pin your versions.

but the embargo delayed the updates