What about cases when the update fixes a security issue? Anybody using this approach would be a target for a few more days.

I know it sounds preposterous but there there are more ways to apply patches than npm pull