Do you have an examples of things you've felt compelled to update? Electron does have a lot of reported vulnerabilities, but are you sure those vulnerabilities actually impact your product? Usually properly sandboxing and isolating main / render contexts goes a long way in preventing those vulnerabilities from being exploited. One approach may be to attempt to triage the vulnerable dependencies rather than update them immediately?