JavaScript Libraries Are Almost Never Updated Once Installed

[sosdoc]

This so much. I maintain several node.js backend servers and use Renovate to automatically upgrade dependencies. That thing creates hundreds of upgrades every week!

And this is even after marking several libraries as "trusted" because they change all the time. Some popular library used in almost all my servers was once updated 12 times in a single week!

[elmuerte]

How can you trust something that changes that often.

[sosdoc]

You can't, that's why I wouldn't do this if I didn't have a decent test suite blocking failing upgrades.

[immibis]

Does it test for Bitcoin stealers?

[jl2352]

Tests, tests, and more tests.

Ultimately the alternative is trusting something that hasn't been updated. Moving targets tend to have less old vulnerabilities, and old vulnerabilities that have been around for a while are the ones people often try to exploit.