The issue with updating dependencies

Published on 2026-04-16 18:49

Last Summer I knew that I'll either leave my current job by Christmas or I start liking Ops-y things. By Ops-y things I mean the range of tasks from deployment to dealing with dependencies. Since I haven't quit my job, let's talk about the latter.

With recent supply chain attacks, updating dependencies feels a bit more dangerous than it used to. Months after release of Angular 2 it was normal to update dependencies as often as possible as there were new features with every release. Almost ten years later updating dependencies feels like walking through a minefield.

This week I've had to deal with dependencies in my Brotberuf and on my side project. Neither was without hiccups.

At my Brotberuf we have set up dependency audit for vulnerabilities, so we can only merge pull requests when dependencies are not marked as vulnerable. Unfortunately for us, this week we had a bit more packages to update than usual. Even worse, one of the updated packages broke build process because it was no longer compatible with the version of Vite which we used.

The issue with updating Vite is that other parts of the build can fail. In our case the issue occurred during post-processing because Vite, or rather rolldown, changed the automatic code splitting strategy.

On my side project I've moved from Ruby on Rails 7.0.2 to 8.1.0. So three or four years of development. First attempt of trusting the scripts and going directly to the desired version ended up in bunch of errors. I did try to look them up but I was left none wiser.

So what helped was to revert everything and go up by minor versions. There are some kinks like Rubocop to be sorted out but the backend part works and I was able to fix one small bug as well.