[chrisseaton]

> You're committing yourself and your team and employer to the ongoing maintenance of the fork and merging of upstream changes, just so you can merge a bug fix. Usually, that's just not practical.

Seems easy enough to build a custom fork in your CI and use that in your deployment. You could even automate the merge from upstream once a day. How often do you find merge conflicts in practice?

[klabb3]

Many projects aren't pure library deps. If you need to fork a CLI tool for instance it tends to be a lot more involved. Even pure library deps can be a pain depending on the version manager you're using. Also, I often need to use a temporary fork even if I'll get it merged later, because the fix blocks something I'm currently working on.

Forking, when there is good tooling, is really nice. I wish tooling and practices were more mature. It's often a lot more hassle than ideal.

[mannykannot]

The tooling being used is also mostly open-source, and you have the same options - and difficulties - there.

The more people complain "but it's hard", the more they demonstrate how indebted they already are to those who have made open-source what it is today.