That's an issue with almost the entire js ecosystem. I'm part of a project that has rather high security standards, so we have to keep everything updated. The Java side is almost trivial, update some version number, let the tests run and you're fine. The js side is a constant battle against incompatibilities, weird changes for no reason and simply tons of vulnerabilities.