One of the things that worries me about nodejs is the huge chain of dependencies. I&#x27;m not an expert on these things so it would be amazing if someone could correct me if I&#x27;m wrong.<p>It&#x27;s enough for one of the packages down the line to break compatibility and don&#x27;t change the version correctly  (i.e. bump up major version number bit), or have a slightly too loose version requirements and everything breaks down the line. Ok, if something gets broken it&#x27;s relatively easy to notice given the test coverage is good enough.<p>However, it&#x27;s much much harder when it comes to security breaches (like the one described in the linked article), you might not notice it for a long long time.<p>Anecdotal data but I tried to teach the interns to use yeoman when they were working on a small angularjs project and it just didn&#x27;t work, because some dependency somewhere was broken. Happened to me as well and the solution was to try to update it a few days later (should  have opened an issue, I know).<p>I&#x27;m using npm shrinkwrap to avoid surprises but still.. It just doesn&#x27;t feel right. I shouldn&#x27;t be risking to break the project just by updating the dependencies, unless I&#x27;ve decided to update one of the dependencies to a new major version.