,
4 tweets,
1 min read
Read on Twitter
"Update all packages to latest versions" is scary, because what if one of those releases is an hour old and breaks something? I'd much rather do "update all packages to the latest version that is at least three days old." Does any package tool support that kind of update?
Obviously this would be a problem if everyone did it, because then no release would get tested until day three. But I'd expect usage to stabilize into a group of slower-updating users who have stable apps in production, plus a group of faster-updating users working on new apps.
Tests can't save you from a bad package release. Security vulnerabilities, performance regressions, etc. And your tests are finite; they aren't written to anticipate the infinite number of bugs your dependencies could have.
Tests can't save you from arbitrary upstream mistakes. If you expect them to then your risk analysis is going to be way off.
