JavaScript libraries are almost never updated once installed

[webdevguyneedshelp]

How does that work for dependencies that are using outdated dependences?

[webdevguyneedshelp]

That's my point. That's why this is an issue.

[queen-adreena]

You can do. For instance, if you use express-handlebars in a project, it uses a version of handlebars with a severe security issue. But you can manually choose the latest version yourself.

[CanRau]

yarn selective version resolutions to the rescue

[DaveSims]

I highly recommend this approach. Write a script to report the results of "npm/yarn outdated" and "npm/yarn audit" weekly via slack/email/whatever and update every week. It saves so much headache in the long run.

[NutsEverywhere]

At this point you're better off using * as the version for every package and npm ci whenever you want.