> why put effort in upgrading libraries and exposing yourself to possible issues.

Isn't this what the combination of a "package manager" with semantic versioning scheme actually should automate?

Personally, I think this is where NPM failed and still fails. They should enforce a binary format that ships with header files (and method signatures), and enforce semantic versioning.

If any library doesn't play by the semantic rules, don't let it publish. That's the authority and responsibility that NPM failed to include.

If everybody plays by the semantic rules ... then libraries can be upgraded automatically without breaking anything. And a huge plus: They can be installed as _shared_ libraries, which is such an old concept that it hurts my fingers having to type its advantages.