The WordPress ecosystem urgently needs version control.
I'll keep this brief. CVEs are getting out of control. Supply chain attacks are becoming uncomfortably common. I don't have the exact number, but I'm pretty sure the number of compromised plugins in the past two months has to be somewhere around 100.
Security-minded teams in source-controlled ecosystems can mitigate their exposure by vetting versions and only updating when the security of a specific version is absolutely certain.
WordPress does not have that luxury. We are stuck between the rock of outdated and potentially insecure versions of themes and plugins, and the hard place of potentially volatile updates.
We urgently need the ability (not composer, an actual first-class .org solution) to update to specific versions, not just whatever is most recent.