3 ms·
It’s also easy to stick with #1 and leave pinned to specific versions and only update for security reasons. This used to be a pain so automatically updating wa
by prepend 5y ago
It’s also easy to stick with #1 and leave pinned to specific versions and only update for security reasons.
This used to be a pain so automatically updating was an easy way to stay up to date and reduce risk. But now with dependabot, I can pin to specific versions and leave it there forever, until dependabot detects the vulnerability and submits a PR.