[sudo_bang_bang]

Very rarely do I so vehemently disagree with a particular argument in software. This idea epitomizes much of what is wrong in the industry.

We can all agree security updates are essential, but a lot of libraries are “done” from a functional perspective for a majority of their existing use cases.

Yes updates can be needed because interfaces break between other programs, standards evolve in backward incompatible ways, performance improvements can be made, etc. But much of the updates I see are changes for the sake of changes.

You could use a 5 year old version of React for example, and modulo some set of security fixes if any, you could have a robust application.

Sometimes software is just done. We are better off for accepting that idea. Get us off the update hamster wheel and stop the enshittification.