What's your dependency update frequency?

For my backend framework I try to keep up with major releases and security fixes. Especial security patches are really important.

For frontend I tend to just keep working with what works unless I notice I'm missing out on features or bugfixes.

Every major dependency I use I subscribed to their releases on GitHub, every day I check my notifications on GitHub and read through release notes, if it seems like I need to update because of a security thing (For example Next.js v9.4.5 yesterday) I run the command to update it to latest in my project. Everything else I do periodically.

We spend 20-30% of each week on maintenance, including dependency updates. We found it is the most reliable way to get these things done.

We call "maintenance" also small changes & non-critical bugs. We keep a backlog and prioritize them every week.

I wrote about it more in detail here 👉 https://refactoring.substack.com/p/how-to-plan-and-execute-maintenance 😊

I'm somehow missing a "When a dependency faces security updates or functional updates that I intend on using" option. Is that just me?

I mostly create JavaScript applications and use npm, updating is always a pain as it is very likely to break stuff or introduce hidden bugs. I usually only update if there have been major releases or if there are new features or performance improvements in the latest releases.

It's a bit of a cop-out, but I generally make a decision based on how likely a security problem will be a disaster. So, there are some projects where the team was obliged to update all packages before testing anything, and then I have desktop applications that are primarily just for me that I'll update whenever I need to make significant changes to the code for something else, which might be "never," or might be multiple times a month, if it's a tool I use frequently.

I think of it from an "if I let this slide, what are the chances I'll look like a jerk?" basis, basically...