Unless you just... Keep using the old version of the framework? No one is making you upgrade

jonnyasmar 3 hours ago | parent | next [-]

You can, and sometimes that's the right answer. Where it gets hard: security CVEs that need patching but the fix is only in the new major, transitive deps that bump and bring incompatibilities, hiring a contractor who doesn't know your locked version. None of those are insurmountable, but they're real tax.

▲

em-bee 2 hours ago | parent | prev [-]

the problem is that you have to keep all the artifacts around so you can keep building with the old framework. especially in the npm world that is incredibly annoying. my solution for javascript at least is to avoid build tools alltogether, and build the site in such a way that it runs without a build step only using frameworks that support that. since the code runs in the browser there are no security concerns because you can't trust that code anyways.

	▲	materielle 2 hours ago \| parent [-]
		Which brings us to the next layer of modern dependency management insanity: The fact that basically none of these multi-million dollar companies are vendoring their entire dependency tree. At most companies, even ones worth millions of dollars, it would be impossible for them to rebuild their software if someone ripped a package off of npm’s registry or whatever.