> build from source or make their own images vs those who rely on provided images and upgrade them often.

I mean - this incident brings it into sharper focus - but it's always been thus.

As a Go developer I often tell people "Be wary of vendoring, you are creating a cache of dependencies that need to be managed and maintained"

Or people that "pin" dependencies, they face the same difficulty.

Why not just use "official" (in this case) images - sometimes they lag too - hell, most Linux distributions lag so much with Go compiler packages that, again, I routinely tell people to avoid them in favour of watching the Go official page

I'm curious what you mean about vendoring.

In go, vendoring dependencies just copies the deps out of the module system into the local tree and it's managed the same as not vendoring. It won't even build of the go.mod has changed without also updating the vendor tree.