Direct dependencies are on current major versions

Running a major version that is 2+ releases behind the current means you are on a branch of the dependency that no longer receives backported security patches. React 16 does not receive fixes for vulnerabilities discovered in React's rendering pipeline. Express 3 has not received security patches since 2015. OWASP A06 (Vulnerable and Outdated Components) directly names major version lag as a risk vector. CWE-1104 (Use of Unmaintained Third Party Components) applies when the installed major version has reached end-of-life. The deeper the lag, the larger the eventual migration — skipping from React 16 to 19 requires addressing three sets of breaking changes simultaneously, while each single-major upgrade is manageable. Major version lag is technical debt with a compounding interest rate.

Upgrade primary framework dependencies one major version at a time to minimize the blast radius of breaking changes. Check what's available before upgrading:

npx npm-check-updates -u --target major

Review the migration guide for each framework (React, Next.js, Vue, etc.) before running the install, then run your full test suite:

npm install react@latest react-dom@latest
npm test

Fix failures before moving to the next major. Never skip multiple majors in a single PR.