Don't break Debian page is quite clear that always installing the latest versions of third-party software from from places other than official Debian repositories is not a good idea. Although the article tells a lot of things, it comes in essence to the following points:
- Third-party sites may not be trusted as much as Debian repositories.
- Newer versions of a software product may contain new bugs.
- Newer versions haven't been tested thoroughly with a specific version of Debian.
- There may be issues between newer versions of a software and other software products installed on Debian machine.
I'm not sure how should I apply the advice in the following situation. I'm deploying a cluster of virtual machine which will be used to host several instances of RabbitMQ. The official Debian repositories for Debian Stretch come with version 3.6.6, which, it appears, was released more than two years ago, with a lot of versions being released since then.
My use of RabbitMQ is very basic, which means that I won't probably benefit from all the new features which were released. What scares me, however, is that most of the new releases claim to have fixed bugs, which, I suppose, includes security issues.
Therefore, should I ignore the recommendation of Debian documentation and install the software product such as RabbitMQ from the source recommended in the documentation of RabbitMQ, or should I stick with the old version provided through official Debian repositories?
Or there is absolutely no way to answer this question, without checking the entire list of changes and manually evaluating the risks?
Note: although I illustrated my question with RabbitMQ, it applies to most server-side software I have to install, such as PostgreSQL.