4 ms·
It's the dependency updates. It doesn't consider if the update makes sense or not. If it fixes vulnerabilities it must be updated, but just for the sake of upda
by tiborsaas 3y ago
It's the dependency updates. It doesn't consider if the update makes sense or not. If it fixes vulnerabilities it must be updated, but just for the sake of updating, I don't see the point.
- noahtallen 3y agoIf you don’t want to update dependencies frequently, then you should probably stop using (or reconfigure) the tool whose primary purpose is to help you update dependencies more frequently ;)
- tiborsaas 3y agoWell, I can't not use it since it's a company wide policy, but I agree with you.
- sunshowers 3y agoThe main reason to update dependencies is that when emergencies do arise, you don't want to be in the situation where your only options are: 1. take on the additional risk of months or years of changes in between 2. beg or plead with (or throw money at) upstream to patch your old version 3. attempt to patch it yourself, potentially introducing new issues because you're not the domain expert