Any software development project has to manage the upgrade treadmill, especislly if javascript is involved. In any given week you are likely to see a high or critical update. AI has increased the speed that these are discovered and also how to apply the patch.

In order to be able to apply the patch in a reasonable time you need to keep everything relativly updated. Staying on the bleeding edge opens you to supply chain attacks, getting too far behind makes patching risky.

Security checks are now an everyday operation.

You may want to occassonslly check for any part of the system that is more than a year old.

These checks get painful if you have an overgranular set of microservices as this cost must be paid for each service.

The trick is to work out where your sweet spot is for your system. I am for same day for critical, tomorrow for high and Friday for all others.