@zzt thanks, that's more or less what I've been doing
unfortunately, the CVE deluge means figuring out if there's something actually critical to me in there is no longer practically possible
and I'm a bit worried that minimal due diligence isn't enough to avoid e.g. subtle filesystem corruption bugs introduced by slopcoding that don't show up for a few weeks or months

~mew~