@rune@mastodon.nzoss.nz

What do you mean "packaged before 2015"? This obviously depends on programming language, but if it's a JAR that was packaged before 2015 this effectively means all libraries inside are also pre-2015? For Python, it's mostly about what versions you pin in requirements.txt.

I realize there's no silver bullet here, but over years I'm believing more and more that continuous integration with integrated testing is the only way to maintain apps in long term.