[coldtea]

>I generally thought it was best practice to always update to the latest patch release. I mean, that's what `apt` is doing for the system-installed version.

Well, if it's publicly accessible, yes. Though even there you don't just "update to the latest patch release" you need to check it first (at least with your test suite), it might break your functionality and even introduce security issues due to that, regardless of what the upstream "semantic" versioning implies.