Pick a steady rhythm and a faster lane for security fixes. A common split is routine updates weekly or every two weeks, and critical fixes within days. Small, frequent upgrades are easier to test and roll back than one huge upgrade once a year.
Why waiting costs more
Every month you skip adds changes to the eventual jump. Release notes pile up, breaking changes combine, and the person doing the upgrade does not remember why the code was written that way. When a security fix finally forces the upgrade, you do it under pressure and across several major versions at once.
Two lanes
Routine lane. Patch and minor updates, batched by ecosystem or by group so you get one pull request, not forty. Review on a fixed day each week or fortnight.
Urgent lane. Fixes for vulnerabilities that are exploited or that you can reach. These skip the schedule and go through a short path: review, test, ship.
Where major versions fit
Treat major versions as small projects. Put them on the roadmap, read the migration notes, and do one at a time. Do not mix them into the routine batch.
Adding a short delay
Some teams wait a few days before taking brand new releases. That gives the community time to find a broken or malicious version first. Many update tools offer a cooldown setting for this.
Make it cheap
Upgrades stay cheap when you have tests, a lockfile, and a way to roll back quickly. Without them people avoid updating, and risk piles up quietly.
A measure worth tracking
Track how old your oldest direct dependency is, and how many are more than one major version behind. If those numbers climb, your cadence is too slow.
What about frozen systems
Some systems cannot change often, such as certified devices. Then you still need a schedule, a list of what you run and a plan for security fixes, even if releases are rare.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how new advisories appear against versions you already run, which is why a fixed schedule alone is not enough.
Quick check
Is updating daily better than weekly?
Not necessarily. Weekly batches are easier to review. Keep a fast lane for urgent security fixes.
Should I update everything at once?
No. Group routine updates, and handle major versions separately.
Last reviewed: 19 October 2026.
