Hacker News Reader

You can always use something like dependabot, which should help you quickly upgrade versions and also protect you from breaking your build.

If a package doesn't provide a stable branch that will receive security updates then it's not mature enough to be used anyway. That's the sensible middle ground between bleeding edge and security, unfortunately most packages/projects aren't mature enough to provide this.

There's a reason companies stick with old COBOL solutions, modern alternatives simply aren't stable enough.

I get notifications to update my Rails apps from GitHub as a matter of course when there's a CVE in my dependencies. Does this kind of thing not exist/is impractical for JS?

From my experience of getting ~30 of those notifications per week for a handful of JS repos, I can very much assure you that it does exist.

As a fellow commenter said, you would ideally use something like dependabot or greenkeeper/snyk.