The upgrade trap: when upgrading is the wrong answer to a CVE

This report explains the "upgrade trap": upgrading dependencies is widely recommended for CVE remediation but can fail when no patched version exists, fixes haven't shipped, or upgrades introduce breaking changes (or even malicious code via compromised maintainer accounts). It uses npm supply-chain incidents (malicious chalk/debug releases) and examples like deprecated or EOL packages and major breaking fixes to show how automatic upgrades can distribute malware, accumulate technical debt, and leave organisations exposed; it argues for targeted fixes that patch the code in-place as an alternative to blind upgrades.