Microsoft also isn't your average developer that imports libraries from strangers.

Ever time I run an audit (which is monthly) I see at least a dozen conversations in NPM packages we use. Sure, some of them don't apply to our usage, and others can't really impact is, but occasionally there is one we should be concerned about.

We server admins can push buttons to upgrade, but that doesn't mean developer code will keep working.

Many developers live in this world were they think server admins will protect their app... But we're more likely to break things by forcing your neglected package upgrades