All those folks telling me to update my dependencies, this is why I don't do it. It's not laziness, it's undeniable foresight.
All those folks telling me to update my dependencies, this is why I don't do it. It's not laziness, it's undeniable foresight.
As long as your versions don't have any security issues...
I mean, yes, update your dependencies. But probably after a week or so after they've been release and tested by the first penguins willing to jump into the ocean.
Holding periods for new updates are a good idea, but I would also prefer having a tool that could provide diffs of the entire project state pre- and post-update; including transitive dependencies being added or removed. Git diffs won't show you that information, by design.
What purpose does “undeniable” serve here? This tips over into hyperbole, in my opinion, whereas “it’s foresight” is much simpler and stronger. YMMV.
I think it was to make the tongue-in-cheek nature of the comment more apparent.
That’s undeniable.
There's a reasonable solution to this. Tools like `cargo-audit` can tell you if a crate has security issues and guide you towards an update. You don't have to blindly update all dependencies this way.