Hacker News Reader

the dependency is open source ya?

if upgrading is that bad can always (usually) patch it yourself

That would be your own fault for using immature libraries that don't offer stable versions with security and bug fixes. Unfortunately that's most of the npm library and a growing problem in other ecosystems.

I commented with a realistic and common use case in mind. We can talk idealistic / paranoid scenarios too, but that's just not how majority of developers work, so it's a bit of a moot point.

> We can talk idealistic / paranoid scenarios too

Have we sunk that low that the idea of using mature, stable and supported libraries is idealistic and paranoid now? It used to just be called responsible.

> but that's just not how majority of developers work, so it's a bit of a moot point

I don't think identifying the root cause of an issue is ever a moot point.

YAGNI (at least until YNI)?