Tierney Cyren

You need to automate vulnerability monitoring You need to automate runtime updates You need to automate dependency upgrades You need to cache dependencies You need to automate releases You need to contribute

All that said, our tooling isn't there... yet. Addressing each of the points above:

 There is tooling to automate your vulnerability monitoring, but IMO the remediation features aren't even close to fleshed out enough to be The Solution. The tools we need are out there, but the dots haven't been connected... yet.

There isn't much tooling for intelligence around upgrading your @nodejs runtime. There is a minimum secure version of every active release line, but that information is too hard to find for those who don't contribute to @nodejs I'm personally hoping to help solve this one

 The @greenkeeperio bot does a god damn incredible job with managing dependency upgrades, but not enough projects use it. The more projects that start using it, the safer our ecosystem becomes and the faster we get rid of legacy code that hinders everyone. Use it.

Caching deps is something you've been able to do for years. It's v easy to tell that a lot of companies aren't caching deps when a module they depend disappears (left_pad) or @npmjs has an outage. The onus of HA is on your company, not @npmjs... unless you pay for npmE.

Automating releases is a pretty topic in DevOps, and it's something you should be doing for every npm module, every JavaScript app, and every Node.js service. If you're not automating, you're going to drown under the flood of changes from the previous four points.

This one is a bit of an outlier, but it's an important one. Be the change you want to see. Contribute to the libraries that you use and that need help, not just the glamorous ones. If there are unnecessary deps, remove them. Pay maintainers on @opencollect.