Re:Automate GitHub Dependency Updates with Dependabot
by paulddraper on Tuesday December 31, 2019 @03:51PM
(#21924633)
I too am interested if frequently updates for the sake of updates leads to better stability or worse stability.
I'm reminded of a single SemVer patch upgrade done for https://github.com/lifaon74/url-polyfill that then subtle broke my application but only in IE (where the polyfill is used) and only in production (because the URL is different). I knew about once the tickets started flooding in.
I have since adopted more of the mindset "if it ain't broke don't fix it." I do run security checks (e.g. npm audit), and I still do upgrade, but I do it at a pace where I can afford good testing and careful attention.
(IE is hard AF to set up tests for, though like all problems it can be solved with more money.)
I'm reminded of a single SemVer patch upgrade done for https://github.com/lifaon74/url-polyfill that then subtle broke my application but only in IE (where the polyfill is used) and only in production (because the URL is different). I knew about once the tickets started flooding in.
I have since adopted more of the mindset "if it ain't broke don't fix it." I do run security checks (e.g. npm audit), and I still do upgrade, but I do it at a pace where I can afford good testing and careful attention.
(IE is hard AF to set up tests for, though like all problems it can be solved with more money.)