Automatically keeping packages up-to-date used to be good advice, but now the ROI for exploiting automatically-updated libraries is high enough that I don't thi

Automatically keeping packages up-to-date used to be good advice, but now the ROI for exploiting automatically-updated libraries is high enough that I don't think it's true anymore. This is more true once you factor in the non-security-related problems with not pinning your dependencies (e.g. when the Cryptography library in PyPI decided to introduce a Rust dependency and broke many people's builds as a result) I've settled for the middle ground of - pinning all dependencies - using something like Snyk to monitor for vulnerabilities in dependencies. - manually updating dependencies that are known to be vulnerable