3 ms·

> Do you manually copy all the external deps into your own project repo, and then manually keep them updated with the latest changes? That is the saner option

• jasonpeacock 5y ago
  > The sanest, of course, is to not update your dependencies unless really necessary, to avoid introducing new bugs. So instead you live with all the existing (and unknown) bugs and security issues? And when you finally do update those frozen dependencies it becomes a nightmare because of all the drift, not just in that package but also its dependencies. You should be updating regularly; if you're concerned about stability then stay a release or two behind latest but that's not guaranteed to more stable than latest. Too often I see people take the approach you're espousing to only suffer more later when they are forced to take an update, and then they become so scared of future updates that they never update again, manually backporting patches, and creating a nightmare legacy application.
• jcelerier 5y ago
  > The sanest, of course, is to not update your dependencies unless really necessary, to avoid introducing new bugs My experience over the 40 or so packages that I regularly use is that updates always have less bugs that old versions though. Even for my system, I build most of the software I use from git head and it just works better than whatever's in Ubuntu or Debian on average