[lightwin]

As other comments also mentioned, maintaining an Electron app is not much different than any other JavaScript application.

My team used to work on large electron & non-electron apps. We used to have a tech-debt ticket every couple of sprints to review and update various packages in order to take care of any potential vulnerabilities.

Most of time updating packages is as simple as running "npm audit fix" command. But sometime we had to manually update major versions of some of the packages and while doing so, we had to take care of any potential breaking changes.

Having a good set of automated regression tests really helps with the process.

[diamondap]

> We used to have a tech-debt ticket every couple of sprints to review and update various packages in order to take care of any potential vulnerabilities.

We should probably start doing that.

We have a pretty thorough set of tests, so we do catch breaking changes from Dependabot in the CI pipeline.

[jpgvm]

i.e Javascript applications in general have poor maintainability.

That is simply the price of Electron. You trade API stability and application maintainability for cross platform and cheaper developers/web tech.