Debian maintainers argue that shipping dead upstream software, such as GTK2, is a growing security and stability liability.