If you are not updating daily any typical webapp tree will accumulate known vulns. Holding back updates is not a sane strategy either. You must review all the

If you are not updating daily any typical webapp tree will accumulate known vulns. Holding back updates is not a sane strategy either. You must review all the new patched versions of all dependencies daily or, failing that, do the work once to drop all the deps you can not afford to maintain reviews for.