How many people are updating the hundreds of packages their NPM apps depend on? General advice is to pin them so they don't break your app daily, which is anoth

How many people are updating the hundreds of packages their NPM apps depend on? General advice is to pin them so they don't break your app daily, which is another way of saying don't update them.. Those packages are also of hugely varying quality, in a language that leaks abstractions for breakfast, and with minimal integration testing between all the versions of all the packages .. Platform frameworks such as J2EE and .NET are much safer by my analysis, although .NET has recently moved to a similar package potpourri.