Never use a dependency that you could replace with an afternoon of programming

Re:Never use a dependency that you could replace with an aft... by markstos on Tuesday August 11, 2020 @04:28PM (#24125599)

Only update dependencies when your code requires the new version, depends on a bug fix or it fixes a security vulnerability. Otherwise, continue using the same version.

Have good test coverage to catch bugs that may originate in dependencies and subscribe to a third-party service to track vulnerabilities in your dependencies.

[ Parent | on HN ]

Re:Never use a dependency that you could replace with an aft... by toomanybeersies on Tuesday August 11, 2020 @08:51PM (#24127595)

Then you get 5 year out of date packages, which eventually have a security vulnerability, and now you have the task of upgrading and working through 5 years of (potentially) breaking changes and deprecations.

It's generally easier in the long run to keep your dependencies up to date. If a package has a new breaking change each week, that's a sign you probably shouldn't be using it for production code.

[ Parent | on HN ]

Re:Never use a dependency that you could replace with an aft... by jonfw on Tuesday August 11, 2020 @06:25PM (#24126724)

When you have a hundred dependencies- who is looking at the release notes to see what security vulnerabilities are being fixed?

[ Parent | on HN ]

Re:Never use a dependency that you could replace with an aft... by markmark on Tuesday August 11, 2020 @07:52PM (#24127282)

Github can do it for you automatically.

[ Parent | on HN ]