Hacker News Reader

Comment by bravesoul2 | Hacker News Reader

I think the issue is API breakage. Does your 5 year old NextJS project still work after npm update? Probably not!

What about your simple Go server or FastAPI server. Probably yes.

So don't run npm updates because sure then you have the security risks that you have some old code and that is five years old and hasn't been worked on for five years and you also have you missing out on new functions and optimizations. However if you have a five-year-old project that you handwritten everything by yourself you probably have a lot of security issues there too assuming that you are using complicated functions like you would have in Next.js. So then you would have to update a lot more than you would need to bring an old Next.js project up to date. You would need to rewrite all your code from scratch almost.

Yes run updates of course. The question is how much of a headache you want.

You can:

Use Next.js (frequently changing lots of transitive deps, suffers from Node ecosystem churn too)

Roll your own framework

OR (FANFARE....)

Use simpler arguably more professional tools. That 10 year old .NET MVC site. Guess what. Still works. Still secure.

10 year old .NET is running on a Windows server that, I hope, you've done some security updates on. Having worked on most web facing stacks out there that might have been the worst one you could have picked as a "future proof" deployment, unless you're comparing them all as something you release once and then never touch again.

But did running Windows Update ever break the website?

Indeed. And did it require a Jira ticket to rearchitecture the app.

guess it depends on def of framework. I would say using .net mvc is a framework.

Are you saying that because you have to touch it all the time, you're sure it's up to date?

I suppose that's one way to look at it.

Any decent sized project will encounter breaking changes in dependencies.

The big frontend frameworks have great backward compatibility and usually provide codemods that automatically update your project.

If you install UI components and other libraries that might get abandoned or have breaking changes in major version updates you might have to put in more effort, that's not different in Go or Python.

Seeing as how FastAPI is only six years old, not sure that works as a great example. One of those projects which has never released a 1.0, so not comforting on backwards compatibility.

> npm update

Patient: Doctor, it hurts when I do this.

Doctor: Don't do this than.

Reply on news.ycombinator.com