Currently, it's very easy to update the version on some dependency and then forget to run node buildSrc/updateLibs.js, which results in the old version still running in production.

We should add some mechanism that enforces these files to be in sync with package.json. I can see two main ways to achieve that:

1. also generate a libs/vendored-versions.json file that needs to be committed when the libs change, then check if it's in sync with package.json during ci
2. alternatively, run updateLibs and check that the vendored files did not change.

1. vendored versions file

Would be easy to implement, but then there's the slight danger of the version file not being committed.

{
   "mithril": "2.2.2",
   "dompurify: "3.1.1",
   ...
}

2. check that running updateLibs is not changing the files anymore

This would be easiest on the developers updating the libs, but it's made more difficult by the fact that the output of updateLibs is not exactly what we're committing:

• we apply functional patches like removing mithrils Promise polyfill
• the formatter is run afterwards (we could maybe add prettier to the rollup build that makes the vendored files)

So at least our patches need to be committed as files and automatically applied in updateLibs before we can add a check like this.