Conill: The long-term consequences of maintainers’ actions

> Other distributions begrudgingly upgrade rust in already released branches when needed, but only because they have to in order to support the security updates of other software. Firefox is an example here.

This seems like a fundamental incompatibility between Firefox's security model and the distribution security model. Upgrading to a new major version of something can mean upgrading to new versions of its dependencies. That's true for any piece of software.

Perhaps it would make sense to have a version of Rust in the distribution used as a dependency of Firefox (and anything else that uses the "you must upgrade to a new major version" security model), and a version of Rust used for everything else that follows the distribution security model (maintain the same major version, incorporate minimal security/bugfix patches).