I looked at what it would take to upgrade our Angular 1.5 to 1.6: weeks worth of trying to untangle dependency hell and testing. For a minor version number upgrade. Let's not pretend it's only the consumers of these libraries that are lagging. A lot of these libraries are maintained by teams who have no business maintaining software, open source or not. They can release all the security patches they want, it won't make a difference if their new version isn't backwards compatible (obviously Angular is egregious and by far the worst I know of where even their minor version numbers have huge incompatibilities, not to mention 3 major version releases in 11 months).