Well, you have to chose something. You can't have security, automated updates to latest version and stability in the same place. You're either in debian/RHEL world with old kernels, old libraries and old userspace tools which miss a lot of fresh features or in npm/pip/curl|bash world, where you have latest version of everything all the time.<p>In former case you can do `apt-get upgrade`/`yum update` and be almost sure that everything will continue working, but - no - you can't have PHP 7.<p>In latter case you either use npm shrinkwrap-like tools to install the exact same version of everything every single time, or play Russian roulette with the new dependency versions. And - just in case if you didn't notice - when you pin some package to a specific version you no longer receive security upgrades for it. And let's be honest - you have a lots of those "^1.0.1", "~0.10.29", "^0.3.1" things in you package.json/Berksfile/... And for almost any package "^0.3.1" is the same as "0.3.1", cause the next version will obviously be "1.0.0" and 0.3.X won't be receiving any more updates.<p>It's obvious that no single distribution will be able to package the insanely large amount of packages from all the different sources, let alone backporting patches. So you either limit yourself to only the stuff available in your distribution, or you're on your own with updates (including security ones).<p>As for the packages updating themselves, sometimes it's a good thing, sometimes it isn't. I bet a wordpress installation which can't overwrite itself (because is owned by root), and doesn't allow executing user-uploaded .php files will be much more secure than one which has full access to itself.<p>P.S. no amount of tooling can solve this problem. If you're using version X of package A, then you find out that there is a security vulnerability in version X which is fixed in version Y and version Y is not fully compatible with version X (changed an API, config file, anything else in a backwards-incompatible way), you're semi-screwed. You will have to handle that situation manually.