Keeping dependencies current

Play this lesson

Hundreds of packages

Remy's package.json lists 40 packages, and they pull in hundreds more. When a flaw is found in any one of them, the studio has to know whether it uses it, and update fast.

Version numbers that talk

Semantic Versioning gives versions three numbers, MAJOR.MINOR.PATCH. The MAJOR number goes up for "incompatible API changes", MINOR when you "add functionality in a backward compatible manner", and PATCH for "backward compatible bug fixes".

Quick check

A package goes from 3.4.1 to 4.0.0. What does that warn you?

  1. Something may break: it has incompatible changes
  2. It only fixes bugs
  3. Nothing at all
Show the answer

Something may break: it has incompatible changes

A new major version is allowed to break things that worked before, so it needs reading and testing.

Ranges and lockfiles

package.json can name a range. A caret, ^1.4.2, "allows changes that do not modify the left-most non-zero element": any 1.x from 1.4.2 up.

package-lock.json "describes the exact tree that was generated", so every install gets the same versions. It "is intended to be committed".

True story: Minecraft and Log4j

On 10 December 2021, Mojang posted an urgent message to Minecraft players. A flaw had been found in Log4j, "a common Java logging library", and it affected "many services", including Minecraft: Java Edition. Mojang warned of "a potential risk of your computer being compromised".

Every version of the game was patched, so players only had to restart the launcher. People running their own servers had to take different steps depending on which version they ran.

Source: Minecraft: Important message, security vulnerability in Java Edition (10 Dec 2021), minecraft.net

Quick check

Why could Mojang fix every official copy of the game so quickly?

  1. It knew Log4j was inside, and the launcher updates the game itself
  2. Players rewrote their own games
  3. The flaw fixed itself
Show the answer

It knew Log4j was inside, and the launcher updates the game itself

Knowing what is inside, and having a way to ship an update to everyone, turned a crisis into a restart.

Updates as a habit

Dependabot "raises a pull request to update the dependency to the minimum version that includes the patch", and the pipeline tests it.

Small updates merged every week keep a security fix one small step away, instead of a jump across years of changes.

Read the gap

package
package:     garden-physicswe run:      1.8.0fix is in:   5.0.2

Priya finds this in Shard Garden's oldest service. Why is the security update hard?

  1. It crosses four major versions, each allowed to break things
  2. Patch updates are always hard
  3. It isn't hard
Show the answer

It crosses four major versions, each allowed to break things

Versions 2, 3, 4 and 5 can each change how the package works. Kept current, the fix would have been one small step.

What a caret allows

Ranges decide which versions npm may pick when the lockfile is updated.

Bolt says: Next: read a version range yourself.

Fact-checked 12 October 2026