Yeah, just lock your versions without updating in the JS ecosystem with typical projects having thousands of dependencies, and watch your CVE count go up every day you don't update.