Security vulns are fixed daily in most webapp dependency trees. If you do not update you are vulnerable to piles of issues anyone can look up. If you update b

Security vulns are fixed daily in most webapp dependency trees. If you do not update you are vulnerable to piles of issues anyone can look up. If you update blindly you may import new obvious supply chain attacks. The solution is actually doing code review. If you can not afford to review 2000 dependencies then you can not afford 2000 dependencies. The extra effort to use a minimal framework and some cherry picked functions may be worth it for most orgs.