Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. I鈥檝e been vocal about this for 10+ years. I鈥檝e always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored).
If you are updating a
