Package Updates

Staying up to date is important but requires a balance of risk and time investment.

Approach

Although we do think it's important to keep packages, dependencies and frameworks as up to date as possible, we don't want to fall into a trap of updating for updating's sake. We usually keep some distance between ourselves and a 0-day release of a package but do try and stay on top of major updates that have hygiene implications or would put us on the back foot when it came time to patch something.