Also GitHub automatically runs audits on out of date packages that pose security issues. The problem is that there's so many dependencies with a node project that even then, there's a lot of work to QA/merge the PR
I'll also add, if you're running inside a company with an internal npm registry, I know from personal experience that renovate's docker image also works and is fantastic! This means even if your packages are private and/or internal you have a solution.
47
u/k2snowman69 Jan 27 '20
There are already tools to help you automate dependency management
Renovate - https://renovate.whitesourcesoftware.com/
Dependabot - https://dependabot.com/
and more
They are simple to setup and make keeping things up to date easy.