For a rough measure of how many packages will break if you perform a minor update to a dependency, try searching “Dependabot compatibility score” on GitHub (or

For a rough measure of how many packages will break if you perform a minor update to a dependency, try searching “Dependabot compatibility score” on GitHub (or just author:dependabot I suppose), each PR has a badge with how many public repo’s CI flows were successful after attempting to apply the patch. By my eye it seems to be generally anywhere from 90-100%. So the question is would you be happy if every time a security vulnerability came out approximately 1 in 20 of your packages broke but you were “instantly” protected, or would you rather wait for the maintainers to get around to testing out and shipping the patch themselves. Given the vast majority of these vulnerabilities only apply in specific circumstances and the vast majority of my packages are only used in narrow circumstances with no external input, I’d take stability over security.