[tivert]

> This is why it is vital to use libraries, frameworks, with a stable, unchanging LTS branch. Failure to do so, means a security update that needs to be applied instantly, cannot be done, without extensive app changes.

It's also another reason why it's important to provide such things.

It's amazing to me how many people seriously argue it's fine to aggressively drop support for old versions and old features to focus on the newest stuff (and that it's totally fine for table-stakes of "having software" is to have engineers continuously working to keep up with changing dependencies.

The reality is the cheapest thing for society is to offer very long term support for old versions, even if it's just security patches, or well-tested backwards-compatibly features in newer versions. It's not sexy work, but it's important.

[b112]

Quite true.

But such things do exist, you just have to vet things first.

For example, stick to a non-rolling distro, such as debia n stable. Everything there will have around 3 years support, with all the security updates done for you.

Debian backports almost all security patches, or sticks with an LTS variant of something (like php) for its lifetime.

No surprise API changes, no sudden need for code changes.

So many people use the latest shiny, and literally only because they're told to. Many need nothing from that bleeding edge version.

When it comes to frameworks, some have LTS versions, stick with those.

And things like node? Heh.