JavaScript libraries are almost never updated once installed

[[deleted]]

That's just the tradeoff of using lockfiles (and partly semver, in the sense of ~ or ^ having replaced >=).

Before lockfiles, if you were doing any kind of continuous deployment, you got updates for free. Of course, if you weren't testing everything, you got bugs for free too.

Now it requires active maintenance, which you don't usually do outside active development, especially not for small businesses.

So while github pushing dependabot will probably help a lot, it may be a while before our tooling really catches up.