> The new shiny seems to be using dependencies straight from git and vendoring them.
That's news to me, it's all npm and node_modules/ as far as I can see.
> How do you keep your projects up to date? Do you manually check every dependency in your project once in a while? Do you have some automation which alerts you to security issues in a dependency of yours?
You can get https://greenkeeper.io/ to watch your project and its dependencies - it creates Pull Requests to update dependencies with details of what changed in the description, and all the usual PR stuff like running whatever CI you've configured happens as a result of creating it.
If I don't have Greenkeeper set up (the PRs can get a bit noisy), I just run npm outdated --depth=0 any time I'm poking about in a project.
> If you decide you need to stay on an older version, is someone backporting fixes?
Depends entirely on the maintainers of that project. Babel 5 has had a couple of things backported, like support for Flow annotations, for example.
> Is there a curated set of packages that are known to work together?
Not curated as such, but you can just look at what people are successfully using and sharing, and tools people are creating. nwb is effectively my own curated package of development tools pre-wired together.
> When an update comes in, do you audit it to make sure nothing malicious makes it on to your systems?
I usually check the diff between the release tags/changelogs between what I'm updating to before, but not specifically security auditing.
> Or does one have to wait until this stuff stabilizes and baked it's easy into linux distributions before one gets these nice features?
That's not going to happen :)