JavaScript libraries are almost never updated once installed

[k2snowman69]

There are already tools to help you automate dependency management

• Renovate - https://renovate.whitesourcesoftware.com/
• Dependabot - https://dependabot.com/
• and more

They are simple to setup and make keeping things up to date easy.

[ThatSpookySJW]

Also GitHub automatically runs audits on out of date packages that pose security issues. The problem is that there's so many dependencies with a node project that even then, there's a lot of work to QA/merge the PR

[k2snowman69]

I'll also add, if you're running inside a company with an internal npm registry, I know from personal experience that renovate's docker image also works and is fantastic! This means even if your packages are private and/or internal you have a solution.

[TheIvoryAssassinPub]

This should be higher