@erikk well keeping track of them is what your package.json is for, and the vast majority of dependencies following this principle basically never have to be updated, and if they do their API will be consistent enough that it's a very simple process. Almost all issues happen when you start using big monoliths like lodash that have such an immense api surface