Anyone tried: https://github.com/emacs-eaf/emacs-application-framework ? Seems it be cool to have Portal as a buffer inside Emacs

Pinning is the only thing saving you from a supply chain attack. It may be a little more work, but then so is taking backups.

I find pinning to be overkill for a personal config (w/o distros such as Doom etc). I just install the latest version of all packages and it works fine. No use-package either, just plain old with-eval-after-load and require. My startup is fast. If I ever have to revert some package (I haven’t needed it so far), I can manually install a previous version. straight.el is cool but it adds more complexity and a bigger surface area for bugs https://github.com/Andre0991/dotfiles/blob/master/emacs.el#L1