The JavaScript stack never sits still, and that is the job

A laptop screen showing lines of source code in a dark editor

I set up a fresh Sanity and Astro project today. The template installed cleanly. Then I did the thing every developer does with a new project: I updated everything to the latest version. Twenty minutes later the site was flickering between a home page and an error overlay.

Nothing in my code was wrong. Two packages disagreed about which version of a third package they wanted, and the build tool picked one. The maintainers had already fixed it in their repository two weeks earlier. They just had not published a release yet. The fix on my side was a single line telling npm which version to use.

Why it feels worse than PHP

A PHP CMS is one package with one version number. Kirby 5 or Craft 5 ships as a unit, and the maintainers have tested the pieces together. A JavaScript site is assembled from dozens of packages with independent release schedules, and the template author tested one particular combination on one particular day. Every day after that, the combination drifts.

The number of packages is the real difference. This project has around fifteen hundred folders in node_modules. Most of them I will never hear of. Any one of them can publish a breaking change on a Tuesday afternoon.

Habits that make it bearable

Commit the lockfile and treat it as the real version number of the project. A lockfile pins every one of those fifteen hundred packages, so a checkout next year installs the same thing it installs today.

Upgrade on purpose, in its own commit, with a build afterwards. Never as a side effect of adding a feature. When something breaks you then know exactly which change did it.

Keep the site's dependency list short. A content site needs a way to fetch JSON and a way to render rich text. Every extra integration, however nice, is another package that has to agree with the others.

And let the templates be a starting point, not a contract. The people who wrote them were demonstrating features. You are shipping a site. Those are different jobs, and the second one is allowed to delete things.