Is there merit to keeping packages/dependencies in a legacy project up to date?

Question

I have been assigned a ticket to update all node packages and dependencies in a react project to the latest possible version without breaking the application monolith as it is now; no further meaningful development of features is planned for this application.

Although I plan to finish the task without much questioning, I was wondering what would be, in general, the merit of having the latest versions of all dependencies in a project of this nature. I tend to understand that maintenance and possible further development would improve by doing this but I was wondering if there could be other justifications for reasonably keeping dependencies up to date in legacy codebases.

Answer 1

Updating a dependency generally grants you some benefits:

• New features;
• Bug fixes;
• Security updates.

Even if you are not actively adding new features to your application, it may still be affected by bugs or security vulnerabilities caused by its dependencies, which may be fixed by updating to the latest version.

In addition, while there may be no planned further development now, there might be in the future. In that case, updating dependencies on a regular basis ensures there will not be a significant amount of technical debt if a new feature must be added, or a new bug is found and requires to update a dependency. This is a judgment call your organization may make depending on the situation.

Answer 2

Generally speaking, I would advise to not update packages if you have no need for the update, purely because it runs the risk of breaking something you already had locked in as working.

The big exception to this is security updates, if relevant for your particular package. To a lesser extent, performance upgrades might also be a valid reason to update.

That being said, there's nothing wrong with updating if you prefer to do so. Just be aware that this may open the door to needing to re-verify that no bugs appeared.

Large projects tend to provide security updates to older versions using minor/patch versioning, which allows you to update the security of your package without having to sign up for other major changes to the library. However, that wholly depends on the developer of the library to do so, and smaller libraries tend not to do such complex versioning (or at least not as commonly).

Answer 3

Yes. Packages can have security flaws, which are then fixed in updated versions. You should monitor all the packages you use for issues and bug fixes and update accordingly.

In real life though. No. use all the open source stuff without checking if its made by Russian hackers and don't update projects that work. Wait untill you need to think up a task for the new guy and then get them to do it. But NEVER DEPLOY THE UPDATED VERSION! it's just too risky