@dalias@hachyderm.io @xgranade@wandering.shop Oh yeah, pinning to a version I can accept and coasting with it is certainly the mode I'm in until I can be arsed to do otherwise. Especially for statically-generated sites, I'm willing to accept that. It may be a bit of a harder case to make in cases where there are dynamic server-side endpoints involved, which may become subject to vulnerabilities that are only patched upstream post-slopification.