[selcuka]

> you just want to see that the file changed

I check the diff for uv.lock (Python counterpart of package-lock.json) every time I merge a PR. It is important to know which direct or transient dependencies have been updated. We don't blindly bump all dependencies to the latest versions (you shouldn't either).

[panzi]

Python packages aren't quite so insane on transitive dependencies. The diff of package-lock.json can be novel length.

[gjvc]

write your requirement.txt files via

    pipdeptree --freeze

to see this clearly

[selcuka]

FYI the uv equivalent is

    uv pip tree

[gjvc]

not interested, really

[Groxx]

same - I check the changelog for every major (== minor if v0) and some minor version changes in most of my projects, including at work. I've caught quite a lot of would-have-broken-something changes, and opportunities for fixes/optimizations/etc by doing so. and sometimes they mention fixing a bug we didn't know we had, so we learned about it early before it corrupted too much data.

[Maxion]

It's nice to have that luxury, we just don't have the manpower to devote to that. Major versions sure, otherwise it's just update and run test-suite and some smoke tests.

[Groxx]

it helps a lot if you make an effort to keep your dependency tree relatively small

[TonyStr]

We are talking about npm here... Any framework like React, Vue, Angular, Svelte, etc. is going to pull in hundreds or thousands of packages. I just checked one of the smallest web projects I have (5 dependencies, no framework) and it has 265 packages In package-lock.json. My personal website (vite + nuxt) has 1171.