Sandstorm has accidentally solved the problem of rapid change by not having enough developers to continually update the available applications, which include Wordpress. You can also ignore updates.
Thankfully, the architecture of Sandstorm turns many types of vulnerabilities in the installed applications into non-events. This means that the lack of updates is not so alarming.
Good to hear Sandstorm is still alive! It is precisely the kind of thing that has some chance of making self hosted popular among the wider public, instead of ever shrinking patches maintained by die-hard enthusiasts inside a sea of corporate silos.
Thankfully, the architecture of Sandstorm turns many types of vulnerabilities in the installed applications into non-events. This means that the lack of updates is not so alarming.
https://docs.sandstorm.io/en/latest/using/security-non-event...