consider minimal version selection like go modules

[edvardchen]

Have the team consider to adopt the "minimal version selection" like go modules? The author explained the rationale well in this blog https://research.swtch.com/vgo-principles.

The benefit is that users won't get affected immediately if some one publishes a vulnerable version of their dependencies.

[arcanis]

We'll have more to share about this in not-so-long.