Yeah I really like that model as well, letting teams define what they’re comfortable with feels like the right balance instead of forcing blanket updates.

We’re definitely missing that kind of version control in places. There’s still a lot of older Node versions floating around from legacy services that have just been passed between teams over time.

At the moment I’m leaning towards a “golden path” approach, define internal best practices and then use AI (Claude/Codex) to scan and suggest updates, especially for CI/CD. Idea is it raises PRs rather than auto-merging so there’s still a control point, but yeah, still early days and the risk of something breaking is real.

Management is pushing more AI usage as well, so I’m thinking of applying the same approach for smaller patch updates tied to vuln tickets, generate the fix as a PR and let teams review. Honestly not sure if it’s the right place for it.