Keeping libraries current.
THE TENSION
Updating breaks things. Not updating accumulates vulnerabilities.
WHAT TO DO
Pin versions for production Update deliberately, on a schedule Test after updating
HOW TO PIN
Record exact versions in your requirements file.
WHY
So the environment can be reproduced exactly.
WHAT TO REVIEW PERIODICALLY
Which dependencies have security updates Which are no longer maintained Which you no longer use
THE UNMAINTAINED DEPENDENCY
A library with no recent activity is a future problem.
Plan to replace it.
WHAT TO REMOVE
Anything unused.
Every dependency is exposure and maintenance.
HOW TO UPDATE SAFELY
One at a time, for anything significant Run your tests Check the change notes for breaking changes
WHAT TO AUTOMATE
Checking for known vulnerabilities in your dependencies.
WHAT NOT TO DO
Update everything on the day before a deadline Leave a project untouched for years and expect it to still work
