Never update anything
I appreciate the contrarian point of view, and I don&#x27;t want to pick on the author, but this sounds like words of wisdom from someone who doesn&#x27;t have much real world experience.<p>I worked in such a project who never upgraded once. And then Specter&#x2F;Meltdown hit, and we had the mandate to patch all our systems (and the threat was very real). Welcome to a hellish mess of outdated deps that took weeks to sort out.<p>But is not only me. I watched a talk from a Principal Engineer from Amazon builder tools, and one of their biggest mistakes was not to upgrade often enough, which made each upgrade more painful.<p>So what do we do now working in multiple, large, multi-year projects?<p>First, we set tools that tell us when deps are outdated, and alarm when vulnerabilities are found.<p>Second, upgrading deps is part of the regular dev process. When you make a change, take the chance to upgrade the deps. Vulnerabilities are addressed proactively. The vast majority of times upgrades require no code changes.<p>Third, we regularly upgrade deps of inactive packages.<p>Lastly, if a dependency upgrade requires significant work, we create a ticket for it and address it as a new feature. In practice this happens very rarely, so it doesn&#x27;t disrupt the development process much.<p>As other&#x27;s said, the key is to upgrade often, and then it wont be as painful.