Software used to ship when it was ready. Now it ships when the sprint ends, when the pipeline triggers, or when another team in the same repository needs to deploy.
The difference is your problem.
The Velocity Invoice
Chrome released every six weeks. Then every four. From September 2026: every two. The browser updates faster than most teams test against it.
Node.js ships a new major every six months. React 18 to 19: breaking changes. Your framework moves on. Your codebase does not.
The pitch was "ship early, ship often." The outcome is software that is never finished, merely current.
The Dependency Invoice
You update your application. Your dependencies update theirs. Their dependencies update theirs.
One npm install pulls
1,400 packages. Each maintained by
strangers who release on their own schedule. The npm registry hosts
over 2.5 million packages
and is the most actively exploited package registry in production use:
supply-chain attacks, typosquatting, abandoned packages with known
vulnerabilities that millions still download weekly.
Dependabot opens 200 pull requests per week on a monorepo. Each must be reviewed, tested, merged. Or ignored, until the security audit asks why you are 47 versions behind.
SemVer promises a patch is safe. In practice, breaking changes ship in minor and patch releases routinely. The contract is voluntary. Nobody enforces it. Your update policy trusts a promise that nobody is obliged to keep.
The Maintenance Invoice
Sixty to eighty per cent of development effort goes to maintenance. Not features. Not innovation. Keeping the treadmill running.
Every update is a test you did not plan for. The vendor tests their code. You test the integration. Your users test the result. Production is the final test environment.
The Kill Shot
CrowdStrike. 19 July 2024. A rapid content update to the Falcon Sensor bypassed the content validator. 8.5 million Windows machines crashed. Airlines. Hospitals. Banks. Emergency services.
One update. No rollback.
$5.4 billion in Fortune 500 damages. 10 to 20 per cent covered by insurance.
Marvellous velocity, that.
The Alternative
Not everything accelerated. Some projects declined the invitation entirely.
PostgreSQL: one major version per year. Five years of support. Minor releases contain bug fixes, security patches, and data corruption fixes. Nothing else.
Debian Stable: releases when ready. Packages frozen, tested, proven. No surprises.
SQLite: backward-compatible since 2004. Twenty-two years. The file format has not changed. Every database written two decades ago opens today without migration, conversion, or apology.
They ship less often. They break less often. This is not a stylistic preference. It is an engineering observation with two decades of evidence behind it.
The Pattern
The industry accelerated releases to deliver value faster. It delivered instability instead, eroding the very trust it promised to increase.
Software used to be finished. Now it is merely the latest version. The invoice is not the update. It is the permanent state of almost working.
Rather an expensive beta.